[cisco_duo] Consolidate the integration onto a single CEL input

# Consolidate the Cisco Duo integration onto a single CEL input

**Package:** `cisco_duo` · **Type:** Enhancement · **Team:** Security Service Integrations

## The problem (user's view)
Collection is split roughly half and half across two Elastic Agent inputs. `activity`, `auth`, `telephony_v2` and `trust_monitor` run on CEL, while `admin`, `offline_enrollment`, `summary` and `telephony` are still on HTTPJSON. Because each input carries its own copy of the connection config, a user enters the same Duo Admin API credentials (integration key, secret key, API host) twice and toggles streams in two places.

There's also a duplicate lurking: `telephony` (HTTPJSON) and `telephony_v2` (CEL) are two versions of the same data, which is confusing on its own.

## Where we are
Eight data streams (v2.11.0): four on CEL, four on HTTPJSON.

## What I'm proposing
Migrate `admin`, `offline_enrollment`, `summary` and `telephony` to CEL, and retire the legacy `telephony` stream in favour of `telephony_v2`. After that everything runs through one input and the connection is configured once.

## Why it's worth doing
- Credentials entered once instead of twice.
- One engine to explain in docs and support, and the `telephony`/`telephony_v2` duplication goes away.
- CEL-only improvements cover every stream.

## What to watch out for
The upgrade is the risky part. Switching input type can reset cursors and cause gaps or duplicates at cutover, so we need a cursor-continuity plan and tests proving no gaps/duplicates. Retiring `telephony` needs a documented deprecation path for anyone still on it.

## Rough breakdown
1. Migrate `admin`, `offline_enrollment`, `summary` to CEL + tests.
2. Retire legacy `telephony` in favour of `telephony_v2` with a documented deprecation path.
3. Prove the upgrade is clean at cutover.
4. Update docs and changelog.

Part of a wider push to put Security Service Integrations packages on a single CEL input. Related: #20286 (SentinelOne), #14813 (Google Workspace), #20288 (Cortex XDR).

Start in the cisco_duo package by comparing the four existing CEL streams with admin, offline_enrollment, summary, and telephony, and review how their connection settings and cursors are handled. Define tests for cursor continuity and duplicate or missing events during the input transition, plus the deprecation path for telephony. Done means all collection uses one CEL input, telephony is retired in favor of telephony_v2, and the documentation and changelog are updated.

Written by the indexing model from the issue text.