[1password] Add users Data Stream to 1Password Integration

## Description
The existing [1Password Events Reporting integration](https://www.elastic.co/docs/current/integrations/1password) currently supports three data streams: signin_attempts, item_usages, and audit_events. The 1Password Events API has since expanded to include a Users API, which exposes user account and provisioning data. This issue tracks the work to add a users data stream to the integration to surface that data in Elastic.

Security teams using 1Password with Elastic SIEM today have visibility into activity (sign-ins, item access, audit actions) but no structured way to ingest or query user identity and provisioning state directly from 1Password. Common use cases blocked by this gap include:

- Correlating sign-in attempt anomalies against user account status (suspended, pending, active)
- Detecting dormant or deprovisioned accounts that are still generating events
- Building user inventory dashboards and headcount reporting across the 1Password account
- Cross-referencing 1Password user records against HR systems or other identity providers via [Entity Analytics](https://www.elastic.co/docs/current/integrations/entityanalytics_okta)

Sandbox/documentation access is available upon request.