Read Slack settings through a system-user broker (3.1.0)

[dtwersky]

Summary

• Alerts owned by non-admin users failed with exit code 2 and User does not have permissions,
  because the 3.0.0 settings load needed list_settings and list_storage_passwords. The alert
  action now reads its settings through a REST handler that runs as splunk-system-user, gated by
  a new read_slack_alerts_credential capability.
• Alerts that fire with zero results no longer fail with exit code 2.
• Adds the Logging tab, a slack_alert_action role, and a log line for every credential read.
• Releases 3.1.0, supported on Splunk Enterprise 10.0 to 10.6 and Splunk Cloud Platform.

Closes #68

Upgrade impact

• Alert owners other than admin and sc_admin need read_slack_alerts_credential, granted
  through a role they hold or the shipped slack_alert_action role. Without it, alerts fail with
  exit code 7.
• Known issues are in package/CHANGELOG.md.

Commits

1. CI and dev tooling: pin ucc-gen 6.5.3.
2. The broker, its capability, the alert-path changes and the build hook. Reviewable on its own.
3. Docs, changelog and the version bump.

Test plan

• Unit suite: 190 tests, with unittest and bare pytest, on each commit
• compat-check.py on bundled Python 3.9 (Splunk 10.0, 10.2) and 3.13 (Splunk 10.4)
• AppInspect precert, cloud and private_* tags: 0 failure, 0 error
• Live on Splunk 10.4.3 and 10.2.4: an owner holding only read_slack_alerts_credential
  delivers, and an owner without it gets exit code 7
• Live on Splunk 10.4.3: the broker logs the alert owner, and the troubleshooting curl
  returns the documented status on a default host and on a SPLUNK_BINDIP host