o365: flatten structure, one request per evaluation

[chrisberkhout]

Following #14962, we can simplify the structure of the cel program as described in #14962 (comment).

Benefits:

• Less work/requests per evaulation
• Mapping from existing to new stored state is more direct
• Can do less frequent subscription requests (e.g. once per input startup, or time-based periodic)

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[narph]

@kcreddy, can we close this one if you made the change recently?

[kcreddy]

@narph, in #15476 I handled this part of the issue only:

Can do less frequent subscription requests (e.g. once per input startup, or time-based periodic)

The remaining points described in the issue are still pending.

[chrisberkhout]

When I'm back next week I'll submit a PR for this that I almost had done before I went on leave. I'll update based on Krishna's work and the new PR should close this issue.