microsoft_defender_endpoint: add support for oauth endpoint params - #15667

…lastic#15667)

Add support for the oauth_endpoint_params configuration
parameter for all available data streams.

Log data stream still works under httpjson so the option
has been added under data stream level along with all
the OAuth2 options for this data stream.

For the another data streams, as they work under the
CEL input, it has been added at input level so adding
any value to this option will affect all data streams that
rely on CEL (machine, machine_action, and vulnerability).

Finally, the auth logic for the vulnerability data stream is
implemented in the CEL program instead of delegate in
the CEL auth options for the input.
Therefore, the oauth endpoint params in this case are added
manually in the program as well.

…ty response and 403 (#15749)

{m365_defender,microsoft_defender_endpoint}.vulnerability: Handle empty response and 403 due to expired URLs.

We see cases where the API sends 200 with empty ("") response when 
fetching vulnerabilities using SAS URLs. Since this errored-URL is not 
removed from CEL work_list, it leads to following errors every interval:
"""
failed evaluation: failed eval: ERROR: <input>:2:43: file: EOF
 |   state.?work_list.orValue([]).size() > 0 ?
 | ..........................................^
"""

After a while when the signatures expire (controlled with `sas_valid_hours`), 
following error is noticed:
"""
<?xml version=\"1.0\" encoding=\"utf-8\"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:xxxxxx-xxxx-x-xxx--
Time:2025-10-20T02:07:09.6560520Z</Message><AuthenticationErrorDetail>Signature not valid in the specified key time frame: Key start [Mon, 20 Oct 2025 01:05:29 GMT] - Key expiry [Mon, 20 Oct 2025 02:05:29 GMT] - Current [Mon, 20 Oct 2025 02:07:09 GMT]</AuthenticationErrorDetail></Error>
"""

Handle both these cases in {m365_defender,microsoft_defender_endpoint}.vulnerability 
data stream by adding specific error.message asking users to increase "SAS Valid Hours"
config option. Add troubleshooting section inside the documentation indicating the same.

Also, bring the m365_defender.vulnerability in parity with 
microsoft_defender_endpoint.vulnerability data stream adding oauth endpoint options 
from #15667.

…lastic#15667)

Add support for the oauth_endpoint_params configuration
parameter for all available data streams.

Log data stream still works under httpjson so the option
has been added under data stream level along with all
the OAuth2 options for this data stream.

For the another data streams, as they work under the
CEL input, it has been added at input level so adding
any value to this option will affect all data streams that
rely on CEL (machine, machine_action, and vulnerability).

Finally, the auth logic for the vulnerability data stream is
implemented in the CEL program instead of delegate in
the CEL auth options for the input.
Therefore, the oauth endpoint params in this case are added
manually in the program as well.

…lastic#15667)

Add support for the oauth_endpoint_params configuration
parameter for all available data streams.

Log data stream still works under httpjson so the option
has been added under data stream level along with all
the OAuth2 options for this data stream.

For the another data streams, as they work under the
CEL input, it has been added at input level so adding
any value to this option will affect all data streams that
rely on CEL (machine, machine_action, and vulnerability).

Finally, the auth logic for the vulnerability data stream is
implemented in the CEL program instead of delegate in
the CEL auth options for the input.
Therefore, the oauth endpoint params in this case are added
manually in the program as well.

…ty response and 403 (elastic#15749)

{m365_defender,microsoft_defender_endpoint}.vulnerability: Handle empty response and 403 due to expired URLs.

We see cases where the API sends 200 with empty ("") response when 
fetching vulnerabilities using SAS URLs. Since this errored-URL is not 
removed from CEL work_list, it leads to following errors every interval:
"""
failed evaluation: failed eval: ERROR: <input>:2:43: file: EOF
 |   state.?work_list.orValue([]).size() > 0 ?
 | ..........................................^
"""

After a while when the signatures expire (controlled with `sas_valid_hours`), 
following error is noticed:
"""
<?xml version=\"1.0\" encoding=\"utf-8\"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:xxxxxx-xxxx-x-xxx--
Time:2025-10-20T02:07:09.6560520Z</Message><AuthenticationErrorDetail>Signature not valid in the specified key time frame: Key start [Mon, 20 Oct 2025 01:05:29 GMT] - Key expiry [Mon, 20 Oct 2025 02:05:29 GMT] - Current [Mon, 20 Oct 2025 02:07:09 GMT]</AuthenticationErrorDetail></Error>
"""

Handle both these cases in {m365_defender,microsoft_defender_endpoint}.vulnerability 
data stream by adding specific error.message asking users to increase "SAS Valid Hours"
config option. Add troubleshooting section inside the documentation indicating the same.

Also, bring the m365_defender.vulnerability in parity with 
microsoft_defender_endpoint.vulnerability data stream adding oauth endpoint options 
from elastic#15667.