Skip master-count and bootstrap-password checks when joining an existing cluster (elasticsearch_cluster_set_up=true)

[Oddly]

Summary

Two checks in the elasticsearch role assume a fresh cluster bootstrap and fail when a new node is added to an existing cluster, even though the user has explicitly set elasticsearch_cluster_set_up: true (now respected after #146 / #147):

1. Odd-master-count check (tasks/main.yml, around the Check count of master nodes task) fails when the play targets an even number of master-eligible hosts. Joining one or two new masters at a time to a cluster that already has its own quorum hits this.
2. Bootstrap-password runtime cluster setup (tasks/elasticsearch-security.yml, the block starting Runtime cluster setup (requires running Elasticsearch)) fails on non-CA hosts because the existing cluster's elastic user is no longer the bootstrap password. The block is purely about first-time security setup, which the joining node will pick up via cluster state.

Reproduce (both)

1. Existing multi-node ES cluster with security configured (real elastic password set, working CA, etc.).
2. Provision a fresh master-eligible node intended to join.
3. Inventory:
   ```yaml
   elasticsearch_cluster_set_up: true
   elasticsearch_node_types: [master]
   elasticsearch_seed_hosts: [ ...existing-masters... ]
   ```
4. Run the role with `--limit `.

Expected

Role completes. The new node joins the existing cluster (security/users come from cluster state).

Actual

• If `--limit` covers an even number of master-eligible hosts:

  TASK [Check count of master nodes] ***
  fatal: ... \"There must be an odd count of master nodes. You have 2\"
  

• And/or, after ES is up and joined the cluster:

  TASK [elasticsearch-security | Check for API with bootstrap password] ***
  ... 30 attempts ...
  fatal: ... \"Bootstrap password authentication failed and this is not the
  CA host, so automatic recovery cannot run here. Check the elastic user
  credentials on <ca-host>.\"
  

In both cases ES itself is fine and the node is in the cluster (verifiable via `_cat/nodes`); only the role's bootstrap-flow assumptions cause the failure.

Proposed fix

Both checks are only relevant when bootstrapping a fresh cluster. Gate them on `elasticsearch_cluster_set_up`:

1. `tasks/main.yml` — `Check count of master nodes`: add `- not elasticsearch_cluster_set_up | bool` to the `when`.
2. `tasks/elasticsearch-security.yml` — `Runtime cluster setup (requires running Elasticsearch)` block: add `- not elasticsearch_cluster_set_up | bool` to the block's `when`.

This is consistent with #146 / #147: when the user signals "the cluster is already set up", do not run bootstrap-only checks.

Environment

• elasticsearch role version: oddly.elasticstack collection (current main as of 2026-05-07)
• Ansible: 2.20
• ES: 8.19.10
• OS: AlmaLinux 9

PR follows.