[cloudflare] Make CEL the default and retire the HTTPJSON input

# Make CEL the default and retire HTTPJSON in the Cloudflare integration

**Package:** `cloudflare` · **Type:** Enhancement · **Team:** Security Service Integrations

## The problem (user's view)
This one is a migration left half-finished. The `audit` stream already offers both CEL and HTTPJSON as selectable inputs, and `logpull` is still HTTPJSON-only. A user has to understand two collection engines and, if they enable streams on different inputs, re-enter the same Cloudflare connection details. Offering two inputs on one stream also just makes the setup confusing — which do you pick?

## Where we are
Two data streams (v2.35.0): `audit` offers CEL or HTTPJSON; `logpull` is HTTPJSON-only.

## What I'm proposing
Finish the migration: make CEL the default on `audit` and remove the HTTPJSON option, and migrate `logpull` to CEL. Keep HTTPJSON working for existing installs during a deprecation window. After that there's one input and one obvious setup.

## Why it's worth doing
- One input, one obvious choice at setup.
- One engine to explain in docs and support.
- CEL-only improvements cover both streams.

## What to watch out for
The upgrade is the risky part. Moving `logpull` to CEL and switching existing `audit` users off HTTPJSON can reset cursors and cause gaps or duplicates at cutover, so we need a cursor-continuity plan, tests proving no gaps/duplicates, and a documented deprecation path plus changelog note for the HTTPJSON option.

## Rough breakdown
1. Migrate `logpull` to CEL + tests.
2. Make CEL default on `audit`; deprecate then remove the HTTPJSON option.
3. Prove the upgrade is clean at cutover.
4. Update docs and changelog.

Part of a wider push to put Security Service Integrations packages on a single CEL input. Related: #20286 (SentinelOne), #14813 (Google Workspace), #20288 (Cortex XDR).

Start with the Cloudflare audit and logpull stream definitions and compare their CEL and HTTPJSON inputs. Trace upgrade handling for existing HTTPJSON audit users, then define cursor-continuity tests that demonstrate no gaps or duplicates at cutover. Done means both streams use CEL, HTTPJSON remains available during deprecation, and docs and the changelog describe the migration.

Written by the indexing model from the issue text.