[trend_micro_vision_one] Consolidate the integration onto a single CEL input

# Consolidate the Trend Micro Vision One integration onto a single CEL input

**Package:** `trend_micro_vision_one` · **Type:** Enhancement · **Team:** Security Service Integrations

## The problem (user's view)
Collection is split across two Elastic Agent inputs. `endpoint_activity`, `network_activity` and `telemetry` run on CEL, but `alert`, `audit` and `detection` are still on HTTPJSON. Because each input carries its own copy of the connection config, a user enters the same Vision One API token twice and toggles streams in two places. It's just history — the newer streams landed on CEL, the rest never moved.

## Where we are
Six data streams (v2.13.1): `endpoint_activity`, `network_activity`, `telemetry` on CEL; `alert`, `audit`, `detection` on HTTPJSON.

## What I'm proposing
Migrate `alert`, `audit` and `detection` to CEL so the integration runs through one input and the connection is configured once.

## Why it's worth doing
- Credentials entered once instead of twice.
- One engine to explain in docs and support.
- CEL-only improvements (state persistence, dedup, error handling) cover every stream.

## What to watch out for
The upgrade is the risky part. Switching input type can reset cursors and cause gaps or duplicates at cutover, so we need a cursor-continuity plan, tests proving no gaps/duplicates, and a clear changelog note.

## Rough breakdown
1. Migrate `alert`, `audit`, `detection` to CEL + tests.
2. Prove the upgrade is clean at cutover.
3. Update docs and changelog.

Part of a wider push to put Security Service Integrations packages on a single CEL input. Related: #20286 (SentinelOne), #14813 (Google Workspace), #20288 (Cortex XDR).

Start in the trend_micro_vision_one package by comparing the existing CEL inputs with the HTTPJSON inputs for alert, audit, and detection. Review the integration's upgrade behavior and tests, then verify cursor continuity without gaps or duplicates and update the documentation and changelog as described.

Written by the indexing model from the issue text.