Tweak the 'confine' statements on the 'elasticsearch_user' providers.

With the previous behaviour, _both_ providers were being considered, and
the older users provider was winning. This meant we were using the
deprecated bin/x-pack/users script.