elasticsearch: fix keystore restart notify and non-rolling upgrade

[afeefghannam89]

Two separate bugs in the Elasticsearch upgrade and keystore paths, plus one leftover line.

Keystore credentials never triggered a restart (#540)

The keystore tasks carried changed_when: false, which also kills the notify. Changing a
credential therefore updated the keystore but Elasticsearch kept running with the old value
until some unrelated task happened to restart it.

A version bump upgraded all nodes at once (#546)

Update Elasticsearch if needed was skipped on every host, so raising elasticstack_version
fell through to the plain package: state=present tasks below it and every node was upgraded
and restarted together. Three changes:

• elasticstack-passwords.yml now persists the fetched elastic password with set_fact
  (__elasticstack_password), so it is in scope no matter which role runs first.
• elasticstack-versions.yml is no longer imported only for elasticstack_full_stack, so
  package_facts is always gathered and the installed-version comparison also works standalone.
• The three install tasks are limited to a fresh install
  ('elasticsearch' not in ansible_facts.packages). A version bump can now only take the
  rolling path, and a broken rolling upgrade fails visibly instead of silently upgrading
  everything.