include elasticsearch config in install/update; restart ES earlier

- Added /etc/elasticsearch/elasticsearch.yml to install/update
  scripts.  We can't use the stock config because we need to
  disable dynamic scripting, and run proxied behind Nginx
  (see commit fcafa3517e).
- Restarting elasticsearch now happens earlier in the process
  so that it's running by the time ddrpublic has restarted.
read SECRET_KEY from file; regenerate on install/update