buildkite: enable feature-gated Kibana routes via mounted kibana.yml

[JoshMock]

Opened from failing KB functional tests in test/functional/kb/definitions/. .buildkite/run-kb-tests.sh starts Kibana with only ELASTICSEARCH_* env vars plus three encryption keys, so every experimental/feature-flagged route is off and the corresponding ops 403/404 at request time.

The affected keys contain colons and dynamic sub-keys (e.g. observability:streamsEnableSignificantEvents) that do not survive Kibana's UPPER_UNDERSCORE env-var convention, so mount a config file instead of using env vars. Add a new CI-only .buildkite/kibana-ci.yml carrying the existing ELASTICSEARCH_*/encryption keys plus the feature flags, and mount it in the Kibana docker run:

--volume "$(pwd)/.buildkite/kibana-ci.yml:/usr/share/kibana/config/kibana.yml:ro"

Flags to add:

• uiSettings.overrides.observability:streamsEnableSignificantEvents: true (+ ...GenerativeAiFeatures for AI paths) — significant events (confirmed in Kibana advanced-settings docs).
• xpack.fleet.enableExperimental: [ ... ] — agentless policies, managed integrations, cloud connectors.
• xpack.securitySolution.enableExperimental: [ ... ] — attack-discovery schedule routes (candidate; individual 9.3 flag IDs not yet pinned).

Verify by starting Kibana with the file, confirming the target route no longer 403/404s, then unskip one definition at a time.

Failing test definitions:

Significant events (403, stack):

• significantevents_delete_streams_name_queries_queryid.yml
• significantevents_get_streams_name_queries.yml
• significantevents_get_streams_name_significant_events.yml
• significantevents_post_streams_name_queries_bulk.yml
• significantevents_put_streams_name_queries_queryid.yml

Fleet experimental routes (stack + serverless):

• fleet_agentless_policies_delete_fleet_agentless_policies_policyid.yml
• fleet_agentless_policies_get_fleet_agentless_policies_policyid.yml
• fleet_agentless_policies_post_fleet_agentless_policies.yml
• fleet_agentless_policies_put_fleet_agentless_policies_policyid.yml
• fleet_managed_integrations_delete_fleet_managed_integrations_policyid.yml
• fleet_managed_integrations_get_fleet_managed_integrations_policyid.yml
• fleet_managed_integrations_post_fleet_managed_integrations.yml
• fleet_managed_integrations_put_fleet_managed_integrations_policyid.yml
• fleet_cloud_connectors_delete_fleet_cloud_connectors_cloudconnectorid.yml (serverless)
• fleet_cloud_connectors_get_fleet_cloud_connectors_cloudconnectorid.yml (serverless)
• fleet_cloud_connectors_get_fleet_cloud_connectors_cloudconnectorid_usage.yml (serverless)
• fleet_cloud_connectors_post_fleet_cloud_connectors.yml (serverless)
• fleet_cloud_connectors_put_fleet_cloud_connectors_cloudconnectorid.yml (serverless)

Attack-discovery schedule routes (candidate, stack + serverless):

• security_attack_discovery_api_bulk_delete_attack_discovery_schedules.yml
• security_attack_discovery_api_bulk_disable_attack_discovery_schedules.yml
• security_attack_discovery_api_bulk_enable_attack_discovery_schedules.yml
• security_attack_discovery_api_create_attack_discovery_schedules.yml
• security_attack_discovery_api_delete_attack_discovery_schedules.yml
• security_attack_discovery_api_disable_attack_discovery_schedules.yml
• security_attack_discovery_api_enable_attack_discovery_schedules.yml
• security_attack_discovery_api_get_attack_discovery_schedules.yml
• security_attack_discovery_api_update_attack_discovery_schedules.yml