[carbon_black_cloud] Make CEL the default and retire the HTTPJSON input

# Make CEL the default and retire HTTPJSON in the Carbon Black Cloud integration

**Package:** `carbon_black_cloud` · **Type:** Enhancement · **Team:** Security Service Integrations

## The problem (user's view)
This is a migration left half-finished. `alert_v7` runs on CEL, but `audit` and `asset_vulnerability_summary` each offer both CEL and HTTPJSON as selectable inputs. Offering two inputs on the same stream makes setup confusing (which do you pick?), and users who land on different inputs across streams re-enter the same Carbon Black Cloud connection details.

## Where we are
Three data streams (v4.4.0): `alert_v7` on CEL; `audit` and `asset_vulnerability_summary` offer CEL or HTTPJSON.

## What I'm proposing
Finish the migration: make CEL the default on `audit` and `asset_vulnerability_summary` and remove the HTTPJSON option, keeping HTTPJSON working for existing installs during a deprecation window. After that there's one input and one obvious setup.

## Why it's worth doing
- One input, one obvious choice at setup.
- One engine to explain in docs and support.
- CEL-only improvements cover every stream.

## What to watch out for
The upgrade is the risky part. Switching existing users off HTTPJSON can reset cursors and cause gaps or duplicates at cutover, so we need a cursor-continuity plan, tests proving no gaps/duplicates, and a documented deprecation path plus changelog note.

## Rough breakdown
1. Make CEL default on `audit` and `asset_vulnerability_summary`.
2. Deprecate then remove the HTTPJSON option.
3. Prove the upgrade is clean at cutover.
4. Update docs and changelog.

Part of a wider push to put Security Service Integrations packages on a single CEL input. Related: #20286 (SentinelOne), #14813 (Google Workspace), #20288 (Cortex XDR).

Start with the carbon_black_cloud package and compare the audit and asset_vulnerability_summary streams with alert_v7. Trace the existing input migration and cursor behavior before defining the deprecation path. Done means CEL is the default, HTTPJSON has a safe transition plan, upgrade tests show no gaps or duplicates, and documentation and the changelog are updated.

Written by the indexing model from the issue text.