[bug-hunter] Azure AD graph fetcher validates tracer path even when tracer is disabled

## Impact
Filebeat Azure AD entity analytics can fail to start when `tracer.enabled: false` if `tracer.filename` points outside the managed logs dir. This breaks valid "tracer disabled" configurations and causes startup failure for users who keep a non-default tracer filename while disabling tracer output.

## Reproduction Steps
1. Create `/tmp/gh-aw/agent/repro_graph_tracer.go` with the script below.
2. Run:
```bash
go run /tmp/gh-aw/agent/repro_graph_tracer.go
```

## Expected vs Actual
**Expected:** No error when tracer is disabled (consistent with config validation semantics in `tracerConfig.Validate`, which returns early when disabled).

**Actual:**
```text
ERROR: request tracer path "/var/logs/path.log" must be within "azure-ad" path
```

## Failing Test
```go
package main

import (
"context"
"fmt"

"github.com/elastic/elastic-agent-libs/config"
"github.com/elastic/elastic-agent-libs/logp"
graph "github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph"
)

func main() {
cfg := config.MustNewConfigFrom(map[string]any{
"tracer.enabled": false,
"tracer.filename": "/var/logs/path.log",
})
_, err := graph.New(context.Background(), "id", cfg, logp.L(), nil)
if err != nil {
fmt.Printf("ERROR: %v\n", err)
return
}
fmt.Println("OK")
}
```

## Evidence
- `x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go:132-135` (`tracerConfig.Validate`) skips tracer path checks when disabled.
- `x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go:394-403` (`New`) unconditionally validates tracer path whenever `c.Tracer != nil`, even if disabled.
- `x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph_test.go:615-621` has `tracer_disabled` config accepted during unpack/validation.
- Related open issue check did not find this bug report; existing `#49084` is a refactor proposal, not this startup regression.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Bug Hunter](https://github.com/elastic/beats/actions/runs/22573479823)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Mar 9, 2026, 11:26 AM UTC

Start in x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go, comparing tracerConfig.Validate with the New path-validation logic around lines 132-135 and 394-403. Add a regression case in graph_test.go for a disabled tracer with an outside filename, then run the graph fetcher tests and confirm construction succeeds without a path error.

Written by the indexing model from the issue text.