[docs-patrol] Document winlog forwarded option for WEF setups

Recent code changes in the repository have introduced documentation drift. The following change needs a corresponding documentation update.

## Changes Requiring Documentation Updates

### 1. New user-facing `forwarded` option in winlog is not documented

**Commit(s):** [`37a57bf234d343172034733e0cc7435479bc8953`](https://github.com/elastic/integrations/commit/37a57bf234d343172034733e0cc7435479bc8953)

**What changed:**
- `packages/winlog/manifest.yml` lines 55-66 now define a new visible policy option `forwarded` with guidance that it **must** be enabled for WEF/forwarded events to avoid degraded correlation behavior.
- `packages/winlog/agent/input/winlog.yml.hbs` lines 5-7 now render `forwarded: true` when the option is set.

**Documentation impact:**
- `packages/winlog/_dev/build/docs/README.md` and generated `packages/winlog/docs/README.md` currently have no configuration guidance for the new `forwarded` setting (the Configuration section only documents the Event ID clause limit).
- Add a configuration subsection for `forwarded` explaining when to enable it (WEF/forwarded events), implications if omitted, and that `ForwardedEvents` channel behavior is forced.

## Suggested Actions

- [ ] Update `packages/winlog/_dev/build/docs/README.md` with a `forwarded` configuration section (purpose, defaults, and WEF-specific guidance).
- [ ] Regenerate and verify `packages/winlog/docs/README.md` includes the new guidance.
- [ ] Confirm wording aligns with the policy description in `manifest.yml` so users configuring forwarded events do not end up in degraded state.

> [!NOTE]
>
> 🔒 Integrity filter blocked 3 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#4564](https://github.com/elastic/integrations/issues/4564) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#13075](https://github.com/elastic/integrations/issues/13075) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#784](https://github.com/elastic/integrations/issues/784) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/integrations/actions/runs/24884801318)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on May 1, 2026, 10:38 AM UTC