Add read index privilege to private location policy.

Works together with elastic/beats#33405.

The easiest way I've found to test this locally:

1. Build the integration spec and run elastic-package stack up
2. Log into Kibana and create a private location policy.
3. Create a private location assigned to the policy and add a few monitors.
4. In Fleet, copy policy yaml. Save this to a file and update the output section to point to a CFT url and user.
5. Run elastic-agent container with the standalone policy and local version of heartbeat:

docker run --rm \ 
-v <beats repo>/x-pack/heartbeat:/usr/share/elastic-agent/data/elastic-agent-edc1e8/install/heartbeat-8.6.0-linux-x86_64 \ 
-v /tmp/agent.yaml:/usr/share/elastic-agent/elastic-agent.yml -it docker.elastic.co/beats/elastic-agent-complete:8.6.0