Updates the writer role documentation based on #13847 and #13848. Also corrects some mistakes.

1. Changes read from to the correct write to (Beats does not read from indices).
2. Setting setup.template.enabled to false is no longer necessary after Use less restrictive API to check if template exists #13847.
3. Setting setup.ilm.overwrite to false is unnecessary if setup.ilm.check_exists is already false (even today).
4. Adds a note about only monitor and create_doc being always necessary, explicitly calling out the most secure configuration (following Use less restrictive API to check if template exists #13847 and Do not check for alias when setup.ilm.check_exists is false #13848).
5. Correct what monitor is for: It's for checking things like cluster version and license, not "sending monitor info".
6. Replaces manage_pipeline with the read-only cluster:admin/ingest/pipeline/get. Unfortunately, there is no read-only cluster role for pipelines, so it requires this privilege. But better than the very permissive manage_pipeline that allows changing any pipeline.
7. Changes index to the more restrictive, append-only create_doc (introduced in Add 'create_doc' index privilege elasticsearch#45806).

This is one of three PRs to reduce the Beats privileges required in code and documentation:

1. Use less restrictive API to check if template exists (Use less restrictive API to check if template exists #13847)
2. Do not check for alias when setup.ilm.check_exists is false (Do not check for alias when setup.ilm.check_exists is false #13848)
3. Docs: Update writer role with least required privileges (this PR)

Relates: #10241