[CrowdStrike API CCF connector] Majority of V2_CL columns cannot be populated; device fields not extracted from the `device` object

### Summary
Following the V2 table changes in #14913, a large proportion of the columns declared in
the shipped `*V2_CL` table schemas can never receive data, because the schemas describe
fields the polled endpoint does not return. Separately, host/device attributes that *are*
returned are not extracted, and the parser introduced by that PR is not included in the
package.

---

### 1. Columns that cannot be populated

`/alerts/entities/alerts/v2` (the only entity endpoint the connector polls for both
Alerts and Detections) returns **85** keys. The DCR projects far more:

| Data type | Columns projected | Backed by a returned field | Never populated |
|---|---|---|---|
| Detections | 181 | 85 | **96** |
| Alerts | 162 | 80 | **82** |

The unpopulated set on Detections is dominated by fields from the **legacy Detects API**
(`/detects/entities/summaries/GET/v1`): `HostInfo`, `Behaviors`, `BehaviorsProcessed`,
`DetectionId`, `FirstBehavior`, `LastBehavior`, `MaxConfidence`, `MaxSeverity`,
`MaxSeverityDisplayName`, `OverwatchNotes`, `Quarantined`, `AdversaryIds`, `DateUpdated`.

The V2 schema appears to be a union of the legacy Detects shape and the Alerts shape,
while only the Alerts endpoint is polled — so the legacy-only fields are dead by
construction. Confirmed in a live workspace: 314 Detections rows, `HostInfo` and `Groups`
both empty on 100% of rows.

### 2. Device attributes are not extracted

`device` is returned as a nested object, but the transform is a flat projection with no
`extend` and no reference to `device`. These columns are therefore always empty even
though the data is present in the payload:

`Hostname`, `DeviceId`, `AgentVersion`, `ExternalIp`, `MacAddress`, `OsVersion`,
`Groups`, `Ou`

Current: `Hostname=tostring(hostname)` (no top-level `hostname` in the response)
Expected: `Hostname=tostring(todynamic(device).hostname)`

`Groups` is the practical impact — host group membership is only available inside
`Device.groups`, so users have to unpack the dynamic column manually.

---

### Reproduction
1. Install CrowdStrike Falcon Endpoint Protection 3.4.1 and connect the API connector.
2. `CrowdStrikeDetectionsV2_CL | where TimeGenerated > ago(1d)
| summarize Rows=count(), HostInfoSet=countif(isnotempty(HostInfo)),
GroupsSet=countif(isnotempty(Groups))`
3. Compare against the raw response:
`POST /alerts/entities/alerts/v2` with `{"composite_ids":[""]}` — neither
`host_info` nor `groups` is present; `device` is.

### Suggested fixes
- Remove columns the polled endpoint cannot populate, or poll the endpoint that supplies
them.
- Extract device attributes from the `device` object in transformKql.