[microsoft_defender_endpoint] Consolidate the integration onto a single CEL input

# Consolidate the Microsoft Defender for Endpoint integration onto a single CEL input

**Package:** `microsoft_defender_endpoint` · **Type:** Enhancement · **Team:** Security Service Integrations

## The problem (user's view)
Collection is split across two Elastic Agent inputs. `machine`, `machine_action` and `vulnerability` already run on CEL, but `log` is still on HTTPJSON. Because each input carries its own copy of the connection config, a user enters the same Azure app credentials twice and picks streams in two places. This is the last HTTPJSON stream standing.

## Where we are
Four data streams (v4.9.0): `machine`, `machine_action`, `vulnerability` on CEL; `log` on HTTPJSON. One stream left to migrate — the easiest possible finish.

## What I'm proposing
Migrate `log` to CEL so the whole integration runs through one input and the connection is configured once.

## Why it's worth doing
- Credentials entered once instead of twice.
- One engine to explain in docs and support.
- CEL-only improvements cover every stream.

## What to watch out for
The upgrade is the risky part. Switching `log` from HTTPJSON to CEL can reset its cursor and cause a gap or duplicate events at cutover, so we need a cursor-continuity plan, tests proving no gaps/duplicates, and a changelog note.

## Rough breakdown
1. Migrate `log` to CEL + tests.
2. Prove the upgrade is clean at cutover.
3. Update docs and changelog.

Part of a wider push to put Security Service Integrations packages on a single CEL input. Related: #20286 (SentinelOne), #14813 (Google Workspace), #20288 (Cortex XDR).