Cherry-pick #21884 to 7.x: Use ML_SYSTEM to detect if agent is running as a service

[michalpristas]

Cherry-pick of PR #21884 to 7.x branch. Original message:

What does this PR do?

We were using SERVICE token to detect whether or not agent is running as a service. But it turned out that in many cases this token is missing.

We decided that it would be better to use ML_SYSTEM which should be close enough to detect high elevated runs == service runs.

Why is it important?

TO make agent upgradeable even on windows.
Fixes: #21822

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: [Pull request #22049 updated]

• Start Time: 2020-10-21T15:50:38.047+0000

• Duration: 38 min 11 sec

Test stats 🧪

Test	Results
Failed	0
Passed	1394
Skipped	4
Total	1398

[blakerouse]

Backport looks good.