[m365_defender] Consolidate the integration onto a single CEL input

# Consolidate the Microsoft 365 Defender integration onto a single CEL input

**Package:** `m365_defender` · **Type:** Enhancement · **Team:** Security Service Integrations

## The problem (user's view)
Collection is split across two Elastic Agent inputs. `vulnerability` runs on CEL, but `alert` and `incident` are still on HTTPJSON. Because each input carries its own copy of the connection config, a user enters the same Azure app credentials (tenant, client ID, secret) twice and toggles streams in two places. It's just history — the older streams landed on HTTPJSON before CEL was the default.

## Where we are
Three data streams (v5.15.0): `vulnerability` on CEL, `alert` and `incident` on HTTPJSON.

## What I'm proposing
Migrate `alert` and `incident` to CEL so everything runs through one input and the connection is configured once.

## Why it's worth doing
- Credentials entered once instead of twice.
- One engine to explain in docs and support.
- CEL-only improvements (state persistence, dedup, error handling) cover all three streams.

## What to watch out for
The upgrade is the risky part. Switching input type can reset cursors and cause gaps or duplicates at cutover, so we need a cursor-continuity plan, tests proving no gaps/duplicates, and a clear changelog note.

## Rough breakdown
1. Migrate `alert` to CEL + tests.
2. Migrate `incident` to CEL + tests.
3. Prove the upgrade is clean at cutover.
4. Update docs and changelog.

Part of a wider push to put Security Service Integrations packages on a single CEL input. Related: #20286 (SentinelOne), #14813 (Google Workspace), #20288 (Cortex XDR).

Start in the m365_defender package by comparing the existing vulnerability CEL stream with the alert and incident HTTPJSON streams. Define the cursor-continuity approach and add migration tests that demonstrate no gaps or duplicates at cutover; update the integration documentation and changelog when the upgrade path is verified.

Written by the indexing model from the issue text.