Migrate to UCC framework for Splunk 10.x / Python 3.13 compatibility

[dtwersky]

Summary

Rebuilds the app on the Splunk Add-on UCC framework so it installs and configures cleanly on Splunk Enterprise 10.0–10.5 and Splunk Cloud. The alert action itself still worked on 10.x, but the old server-side Mako setup page is deprecated in 10.4 and fails on Splunk Cloud (web assets are stripped during vetting) — that page is replaced by a standard UCC configuration screen.

Existing alerts require no changes: the alert action keeps the same name (slack) and the same param.* fields, and both the Slack App OAuth token and the legacy incoming webhook remain supported.

Closes #64, #63, #61, #56, #55.

What changed

• UCC migration — config-as-code in globalConfig.json; the config UI and alert_actions.conf are generated. Source layout moved from src/app (hand-built) to package/ + globalConfig.json.
• Setup page — the deprecated type="html" Mako template is gone; configuration is now a generated UCC Configuration tab (Settings + Proxy).
• Python 3 — dropped the vendored six shim and Python-2 code paths; uses stdlib urllib. Declares python.required = 3.9, 3.13 (runs under 3.9 on 10.0/10.2, 3.13 on 10.4+).
• Credentials — the global OAuth token and webhook are stored encrypted in storage/passwords and are no longer written or logged in plaintext.
• Alert behavior preserved — message is now a required field (Message should be made a required field in the app #55); attachment fields, severity color, timestamp, and the "link to results" all carry over via the same tokens the legacy app used.
• Toolchain — removed the Node/webpack/yarn UI build (incl. a 5.9k-line yarn.lock) and the bespoke TypeScript AppInspect action; CI now builds with ucc-gen and runs AppInspect from the CLI.

Compatibility & testing

End-to-end verified on real Splunk containers for 9.4, 10.0, 10.2, and 10.4:

• App installs and loads; alert action registered.
• Configuration set via REST; webhook stored encrypted at rest.
• A scheduled saved search fires a live alert that Slack accepts (HTTP 200) on every version.
• Runs under Python 3.9 (10.0/10.2) and 3.13 (10.4+).
• Passes AppInspect cloud precert with 0 failures.

Test plan (verified in containers across 9.4 / 10.0 / 10.2 / 10.4)

• Install the built package on Splunk 10.4; open the Configuration page (no 500).
• Configure a Slack App OAuth token (or webhook); confirm it is masked in the conf and encrypted in storage/passwords.
• Fire an alert (ad-hoc | sendalert slack ... and a scheduled saved search); confirm delivery.
• Confirm an existing pre-upgrade alert still fires without edits.