Various pipeline fixes for CCR reliability

[alexwlchan]

Closes wellcomecollection/platform#5295, closes #1862

• Image inferrers now get dedicated capacity providers for TEI on/off (h/t @alicefuzier)
• We now get the version of Elasticsearch that the API is using, so we never step ahead of it. This means CCR can't get its versioning in a twist.
• We now run two, smaller Elasticsearch nodes in the pipeline cluster when we're not reindexing – for high availability and offset costs
• We no longer depend on the Elasticsearch cluster for all the pipeline resources. This is a "clever idea" I had when setting this up that means services won't be created before the relevant secrets are ready, but:
  1. It creates unreadable Terraform plans.
  2. If those secrets aren't ready, the services will just restart until they are. Not a big issue.

[kenoir]

Nice.

[alexwlchan]

All @alicefuzier’s work :D