[Outlook] Deprecate full_access_as_app permissions in favour of Graph API permissions for Outlook Cloud

## Problem

Outlook Cloud connector requires `full_access_as_app` permission, see our official docs: https://www.elastic.co/docs/reference/search-connectors/es-connectors-outlook#es-connectors-outlook-client-connect-to-office365-outlook-outlook-cloud

This permission / EWS path is being deprecated by Microsoft by 1st April 2027 with deprecation starting in October 2026: https://techcommunity.microsoft.com/blog/exchange/exchange-online-ews-your-time-is-almost-up/4492361

We need to adjust the connector to only use Graph API for Outlook Cloud. In practice this means separation into Outlook Cloud and Exchange Server connectors, because the systems differ.

**Decision:** create new service types for backwards compatibility — legacy `outlook` stays frozen; new types are `outlook_cloud` (Graph-only) and `exchange_server` (EWS + LDAP).

## Target

| Service type | Target | API |
|---|---|---|
| `outlook` (legacy) | Existing deployments | EWS (frozen / deprecate) |
| `outlook_cloud` (new) | Exchange Online / M365 | Microsoft Graph only |
| `exchange_server` (new) | On-prem Exchange Server | EWS + LDAP |

`outlook_cloud` v1 = **full parity** with current cloud sync: mail (4 folders) + calendar + contacts/DLs + tasks + attachments + DLS.

## Sub-issues (execution order)

### Phase 0 — Design
- [ ] #4346 Epic design: Graph migration, connector split, regression contract

### Phase 1 — Split / freeze (after design; can run in parallel)
- [ ] #4347 Extract `exchange_server` connector from legacy outlook (EWS, no behavior change)
- [ ] #4348 Freeze legacy outlook connector and document deprecation

### Phase 2 — `outlook_cloud` foundation
- [ ] #4349 Graph client foundation + user enumeration + ping

### Phase 3 — `outlook_cloud` data plane (sequential)
- [ ] #4350 Graph mail sync (inbox, sent, junk, archive)
- [ ] #4351 Graph calendar sync (root + child calendars, birthdays)
- [ ] #4352 Graph contacts + distribution lists
- [ ] #4353 Graph tasks sync (To Do API)
- [ ] #4354 Graph attachments (mail, calendar, task)
- [ ] #4355 DLS + access control sync
- [ ] #4356 Incremental sync via Graph delta/filter

### Phase 4 — Product integration
- [ ] #4357 [Kibana] Native connectors for `outlook_cloud` + `exchange_server`
- [ ] #4358 Documentation + migration guide (`outlook` → `outlook_cloud`)

### Phase 5 — Verification and release
- [ ] #4359 Manual E2E parity validation (M365 tenant)
- [ ] #4360 Release QA issue + backport planning

## Planning preferences (not confirmed — do not close related issues/PRs yet)

- **Mailbox scoping (proposed):** Prefer Microsoft [Application Access Policy](https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access) over an Elastic `client_emails` connector feature. Related: #2843 / #2844 remain open until product confirms.
- **Legacy Kibana UX (proposed):** Prefer hiding `outlook` from create flow once `outlook_cloud` / `exchange_server` ship. Existing legacy connectors would keep working.

## Notes

- Graph does **not** replace EWS for on-prem Exchange Server mailboxes.
- Migrating legacy `outlook` → `outlook_cloud` will require a **full resync** (Graph `_id` ≠ EWS `item.id`).
- Connectors + Kibana native definitions must ship together for native UX.
- Scoped mailbox testing for customers can be documented as an **Entra/Exchange admin** setup if Application Access Policy is chosen.