[abnormal_security] Add Agentless Deployment Support

[mohitjha-elastic]

Description

Add agentless support to the abnormal_security.

Requirements

Following the established Phase I pattern, for each integration see the Onboarding Integration Guide.

1. Technical implementation

• Update integration manifest.yml to enable agentless deployment mode ()
• Update integration documentation with agentless deployment instructions
• Update changelog.md

Example reference: #13367

2. Performance documentation

• Test and document throughput in agentless (requires access to vendor environment and/or sample data)
• Document specific metrics for each integration. For example/where possible:
  • API response time: Average time for vendor API calls to complete
  • Events processed per minute: How many log entries/events the integration can handle
  • Error rates: Percentage of failed API calls or data processing errors
  • Container resource usage: CPU and memory consumption under typical load
  • Vendor-specific limits: Rate limiting thresholds and API quotas

Example documentation format: "Crowdstrike Falcon Intelligence: 200ms avg API response, 5,000 events/min, 0.1% error rate, 512MB RAM/0.5CPU, 1000 API calls/hour limit"

Dependencies

• Agentless infrastructure GA readiness (still in beta)
• Input compatibility: Currently agentless is optimized for httpjson and cel inputs
• UX enhancement: Add agentless deployment filter/toggle to integrations catalog page for better discoverability

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)