Refactor SlowLogFieldProvider

[smalyshev]

Refactoring includes:

• Make SecuritySlowLogFieldProvider not depend on any settings
• Move settings handling entirely to logs
• Consolidate fields methods to one logFields()
• Make EsqlLogger consistent with slowlogs
• Combine create() methods

[elasticsearchmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[mark-vieira]

Some minor comments but otherwise LGTM.

[mark-vieira]

I don't think it's really necessary to mark this volatile. Settings updates are by nature async, so this being somewhat eventually consistent is fine IMO and probably not worth the perf hit on reading this field on every log entry.

[smalyshev]

Since the cluster state changes would be updating this variable, I am concerned the checks may get an old value... probably not likely to matter that much in real scenario, but might make some tests flaky. I can drop it and see if anything breaks.

[mark-vieira]

Ah, I hadn't considered test stability. You might be right. In production it doesn't really matter, it just means there may be some insignificant delay until the setting change actually takes hold.