[DOC] Improve clarity for dervied API key behaviour

[ywangd]

The 7.6.2 breaking changes says:

To create derived keys with no privileges, you must explicitly specify an empty role descriptor.

This could give users the impression that there are options other than "no privileges". But in fact, this is the only option, i.e. derived keys must be created with no privilege. We could improve the wording so the intention is more explicit.

[elasticmachine]

Pinging @elastic/es-docs (>docs)

[elasticmachine]

Pinging @elastic/es-security (:Security/Authentication)