Revisit Elastic Agent certificate handling

[pebrc]

We are currently running the Agent container as root to be able to change the containers' OS trust anchors to add the self-signed Elasticsearch CA ECK uses by default. The only issue we raised in this context was elastic/beats#26529 (which actually does not mention the Elasticsearch CA but the FLEET_CA)

We should:

• test whether setting the Elasticsearch CA using ELASTICSEARCH_CA works and it is correctly propagated to the Beats running in Agent
• if so remove the trust anchor update script and remove the limitation to running as root from the documentation

[pebrc]

Closing this as it has been superseded by #6700 The root requirement did not only stem from the fact that we need to trust the ES certificates but also from the use of a hostPath volume.