fix(incidents): use correct RBAC scopes for delete and read endpoints (fixes #5363)

[asheesh-devops]

Summary

Fixes incorrect RBAC scope assignments in incidents.py where delete endpoints used write:incident instead of delete:incident, and some read endpoints used read:incidents (plural) instead of read:incident (singular).

Root Cause

The delete and bulk-delete incident API endpoints were guarded with write:incident scope instead of delete:incident. This makes it impossible to create a role that can modify incidents but not delete them. Additionally, 3 read endpoints used read:incidents (plural) which is inconsistent with every other scope in the codebase.

The Fix

Update scope strings to follow CRUD conventions:

# Before (wrong):
IdentityManagerFactory.get_auth_verifier(["write:incident"])  # on delete endpoints
IdentityManagerFactory.get_auth_verifier(["read:incidents"])   # plural typo

# After (correct):
IdentityManagerFactory.get_auth_verifier(["delete:incident"])  # proper delete scope
IdentityManagerFactory.get_auth_verifier(["read:incident"])    # singular, consistent

The Admin role already defines delete:* wildcard scope in rbac.py, so delete:incident is properly matched.

Changes

• keep/api/routes/incidents.py — 6 scope string corrections (3 delete, 3 read)

Testing

• Verified Admin role has delete:* wildcard in rbac.py which matches delete:incident
• Confirmed all other scopes in the codebase use singular form (read:incident, write:incident, read:alert, write:alert)
• No existing tests reference these scope strings

Fixes #5363

[CLAassistant]

All committers have signed the CLA.