path.data config is not respected everywhere

[cdfa]

Kibana version: 8.4.1

Elasticsearch version: 8.4.1

Server OS version: 5.19.11-zen1-1-zen GNU/Linux

Browser version: Irrelavant

Browser OS version: Irrelavant

Original install method (e.g. download page, yum, from source, etc.): tarball

Describe the bug:
The path.data config option is not respected everywhere in the application.

Steps to reproduce:

1. Download and extract the tarball
2. Delete the data directory
3. Set path.data to data2 in the config
4. Start Kibana
5. Observe that the data directory is recreated (in my case it contains a folder chromium-xxx

Expected behavior:
The directory at path.data is used for all data storage.

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:
This is an issue for me because for my use case the tarball must be extracted by the root user and I get access denied errors when I try to run kibana as myself, because the data directory is not writable.
I also encountered a few other issues that I don't want to create a formal bug report for ATM, because it's easy enough to work around them:

1. I had expected the path.data config to be resolved against the $ELASTIC_HOME environment variable, but it seems to be dependent on the location of one of the javascript files.
2. The documentation says that Kibana looks for the config at $ELASTIC_HOME/config first, but instead the bin/kibana script tries to find the config find one relative to the script path (with symlinks removed).

[elasticmachine]

Pinging @elastic/kibana-operations (Team:Operations)