[New Integration] Zendesk

## 1. Summary
Collect audit logs and access logs from Zendesk into Elastic Security. Zendesk is a customer-service and support platform; this integration is scoped to its security and compliance telemetry — a record of administrative changes to the account, and a log of who accessed which customer data. Useful for tracking privileged activity, configuration changes, and data access in a system that holds sensitive customer information.

## 2. Vendor and product
Zendesk's REST API exposes two account-level logs relevant to security, both separate from ticket/support content.

- **Transport:** the Zendesk Audit Logs and Access Logs APIs. The integration polls on a schedule and reads new records with a cursor, resuming cleanly. There is no webhook feed for these logs, so polling is the mechanism.
- **Auth:** an API token (or OAuth2, read scope) generated in the Zendesk admin center. The customer's subdomain is a config option.
- **Deployment:** built on CEL as an API pull, so it can run agentless — no Elastic Agent to deploy.
- **Plan notes:** audit logs require a Zendesk Enterprise plan; access logs require the Advanced Data Privacy and Protection add-on and retain only 90 days, so that stream is opt-in and best collected frequently.

## 3. Data
Two typed data streams:

- **Audit logs** — account-configuration and administrative activity: user and role changes, business-rule and settings changes, app installs, API token creation, and logins. Each record carries the actor, the affected object, a description of the change, source IP, and timestamp. The core stream, available on Enterprise.
- **Access logs** — a record of who viewed which data (tickets, user profiles, searches), with the user, IP, request, HTTP status, client, and a human-readable summary. Gated behind the ADPP add-on; opt-in.

## 4. What we get
Zendesk security telemetry in Elastic, mapped to ECS and joinable to the same users and activity across a customer's other data. Audit logs support detecting privilege escalation, risky configuration changes, and API-token creation; access logs support data-access monitoring and insider-risk investigations — who looked at sensitive customer records and from where. Comes with dashboards and detection rules for those cases.

## 5. Dashboards
An audit activity overview:
- changes over time by action and actor
- role and permission changes
- logins and API token creation
- a recent-changes table for review

An access overview (when the access-log stream is enabled):
- access events over time, by user and data category
- top accessors and most-accessed record types
- source IPs and unusual access
- a recent-access table

## 6. References
- [Zendesk Audit Logs API](https://developer.zendesk.com/api-reference/ticketing/account-configuration/audit_logs/)
- [Zendesk Access Logs API](https://developer.zendesk.com/api-reference/ticketing/account-configuration/access_logs/)
- [Zendesk API authentication](https://developer.zendesk.com/documentation/api-basics/authentication/)

Start with the Zendesk Audit Logs API, Access Logs API, and authentication references, then review the proposed CEL API-pull approach and its cursor requirements. The work is done when both typed streams collect the scoped records, map them to ECS, and include the described dashboards and detection rules, with access-log collection optional for eligible plans.

Written by the indexing model from the issue text.