GET _cluster/settings causes non-actionable deprecation warning

[rudolf]

GET /_cluster/settings?include_defaults=true&flat_settings=true causes the following deprecation warning header to be returned:

299 Elasticsearch-8.1.0-SNAPSHOT-ab4581b805ae15d9e3cf3f41dcc7e0498d4b722b "[xpack.security.http.ssl.keystore.password] setting was deprecated in Elasticsearch and will be removed in a future release! See the breaking changes documentation for the next major version."

The deprecation notice only seems to show if the xpack.security.http.ssl.keystore.password configuration option is set.

However, it's not obvious to users how they could resolve this deprecation (at least it wasn't to me). By returning a deprecation notice to an API call it creates the impression that the API itself is deprecated, shouldn't config deprecations only be logged when reading the config file on startup? Returning a deprecation log when a deprecated configuration setting is read through an API causes confusion.

In addition, the documentation doesn't mention that this setting has been deprecated https://www.elastic.co/guide/en/elasticsearch/reference/master/security-settings.html

Related: elastic/kibana#120043

[elasticmachine]

Pinging @elastic/es-security (Team:Security)