[docs-patrol] Update m365_defender README for optional incident alert expansion

Recent code changes in the repository have introduced documentation drift. The following change needs a corresponding documentation update.

## Changes Requiring Documentation Updates

### 1. `m365_defender` incidents no longer always include expanded alerts

**Commit(s):**
- `b4d6acd492ad307c86fa23dbf7e0582d4e076b67` — https://github.com/elastic/integrations/commit/b4d6acd492ad307c86fa23dbf7e0582d4e076b67

**What changed:**
- Added new public stream setting `include_alerts` (default `true`) in `packages/m365_defender/data_stream/incident/manifest.yml`.
- Incident collection behavior is now conditional in `packages/m365_defender/data_stream/incident/agent/stream/httpjson.yml.hbs`:
- `$expand=alerts` is only set when `include_alerts` is enabled.
- splitting by `body.alerts` is only performed when `include_alerts` is enabled.

**Documentation impact:**
- `packages/m365_defender/docs/README.md` still states incidents fetch "all associated alerts and evidence" unconditionally in the "What data does this integration collect?" section.
- That statement is now conditional on `include_alerts=true`; the new setting is not documented in that section.

## Suggested Actions

- [ ] Update `packages/m365_defender/docs/README.md` to state that incident alert expansion is controlled by `Include Alerts` (`include_alerts`) and can be disabled.
- [ ] Clarify recommended configuration when `include_alerts` is disabled (enable the `Alerts` / `alerts_v2` data stream to continue collecting alert-level events).

> [!NOTE]
>
> 🔒 Integrity filtering filtered 2 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - resource:search_pull_requests (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/integrations/actions/runs/23895585397)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 9, 2026, 10:27 AM UTC