Security usage data

[jportner]

This is an issue for multiple pieces of security usage data that we need to augment.

Audit logging

In #82578, we originally planned to remove the legacy audit logger in 8.0. However, preliminary analysis of usage data revealed a not-insignificant number of clusters that support audit logging and have it enabled. That, plus the low impact it takes for us to leave legacy audit logging in place, convinced us to push this breaking change out to a future release.

When we do eventually want to remove legacy audit logging, we'll need to understand how many people are still relying on it. Our usage data currently only tells us whether audit logging is enabled or not. We need to update it to also tell us what kind of audit logging is configured.

Elasticsearch configuration

In #48247, we deprecated using elasticsearch.username: elastic in your kibana.yml file, and in #63186 we deprecated the kibana user entirely. Users should set elasticsearch.username: kibana_system instead.
However, it is a low impact for us to continue supporting this for the time being, so we have decided to leave it in place. We do want to collect additional usage data to determine if users are relying on the elastic or kibana users.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)