Cherry-pick #24829 to 7.12: [Filebeat] Update Oauth2 flow for m365 defender fileset

[P1llus]

Cherry-pick of PR #24829 to 7.12 branch. Original message:

What does this PR do?

Microsoft changed the Oauth2 flow from resource to scope based, so the default configuration and documentation needs to reflect that.

Why is it important?

Module won't work without it.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #24850 updated

• Start Time: 2021-03-30T14:21:07.475+0000

• Duration: 66 min 53 sec

• Commit: bda50e5

Test stats 🧪

Test	Results
Failed	0
Passed	13028
Skipped	2229
Total	15257

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	13028
Skipped	2229
Total	15257

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b backport_24829_7.12 upstream/backport_24829_7.12
git merge upstream/7.12
git push upstream backport_24829_7.12