[Fleet] Clean up documents in `.fleet*` indices related to agents that were already unenrolled

[criamico]

Follow up of https://github.com/elastic/kibana/issues/179399

After unenrolling agents, we leave some documents related to these agents that can be a problem for some users, as they take up space. However this constitutes a breaking change as we've never deleted those docs and in some cases they can be useful for recoverability purposes. So we should find a way to delete those documents only if the users want to.

• [ ] Create a Kibana task that cleans up the documents after some time that agents where unenrolled.
• [ ] Have an opt-in option (false by default) in advanced section of Fleet settings and in preconfiguration that schedules this task only when the user has selected it. Frequency of the task TBD. Note that it should be a global option, i.e. it should apply to all the unenrolled agents, regardless of the inactive timeout being selected or not.
• [ ] Update docs to clearly explain what this option does.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[nimarezainia]

thanks @criamico - can this be an option in the advanced section of the Fleet settings? I think it's a great idea but it would need to be an opt-in as mentioned, and it won't apply necessarily at an Agent Policy level. Globally however, I think we would want the user to make that decision about any agent that has un-enrolled (regardless of the timeout being configured or not).

[criamico]

can this be an option in the advanced section of the Fleet settings?

@nimarezainia yes I think it would be a good place to add it.

I think it's a great idea but it would need to be an opt-in as mentioned, and it won't apply necessarily at an Agent Policy level. Globally however, I think we would want the user to make that decision about any agent that has un-enrolled (regardless of the timeout being configured or not).

I too think that a global option would be more consistent and also more clear for the user. The text description and the docs should explain clearly what this option does, since it can be disruptive in some cases. I'll update the ticket description to clarify those points.