changelog: document apm_user role removal breaking change

[endorama]

Motivation/summary

Add a changelog entry for apm_user role removal, which is a breaking change affecting Tail Based Sampling.

Checklist

• Update CHANGELOG.asciidoc
• Documentation has been updated. Issue tracking this: [Request]: Update APM secure communications with Elasticsearch observability-docs#4718

For functional changes, consider:

• Is it observable through the addition of either logging or metrics?
• Is its use being published in telemetry to enable product improvement?
• Have system tests been added to avoid regression?

How to test these changes

Related issues

#14859

[mergify]

This pull request does not have a backport label. Could you fix it @endorama? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-7.17 is the label to automatically backport to the 7.17 branch.
• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit.
• backport-8.x is the label to automatically backport to the 8.x branch.

[mergify]

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label.

[kruskall]

After this change additional permissions are required for Tail Based Sampling

I think the wording is a bit confusing 😓
The requirements for tbs didn't change. A user will have to specify permission manually if they are relying on apm_user but that would be implicit by Elasticsearch apm_user role has been removed.

[endorama]

I clarified the sentence. It's true that the removal implies those permissions would be required, but I think better clear than having users not address this change.

Do you think the reference to TBS is needed? Something like "after this change, if you are relying on apm_user for TBS permissions..."