Summary

Enhances the existing ServiceNow provider to pull incident activity (comments and work notes) into Keep incidents, and enables bidirectional activity sync.

Closes #3379 /claim #3379

Changes

New Capabilities

• Pull incidents as alerts (_get_alerts()): Maps ServiceNow incidents to Keep \AlertDto\ objects with proper status, severity, and metadata mapping
• Pull incidents (_get_incidents()): Maps ServiceNow incidents to Keep \IncidentDto\ objects with full lifecycle tracking
• Pull incident activity (_get_incident_activity()): Fetches comments and work notes from the \sys_journal_field\ table and associates them as alerts within incidents
• Bidirectional activity sync: New _add_comment()\ and _add_work_note()\ methods to push activity back to ServiceNow incidents via the _notify()\ interface

Mappings

• ServiceNow incident states -> Keep statuses: New->Firing, In Progress->Acknowledged, On Hold->Suppressed/Acknowledged, Resolved/Closed/Canceled->Resolved
• ServiceNow priorities (1-5) -> Keep severities: Critical, High, Warning, Low, Info

Infrastructure Improvements

• Inherits from both \BaseTopologyProvider\ and \BaseIncidentProvider\
• Added _get_paginated_results()\ helper for efficient paginated API queries
• Refactored auth into reusable _get_headers()\ and _get_auth()\ helpers
• Fixed auth logic bug in _notify_update\ (was using basic auth when OAuth token was present, should have been the opposite)
• Added \incident\ to \PROVIDER_TAGS\ and \Incident Management\ to \PROVIDER_CATEGORY\

ServiceNow API Endpoints Used

• \GET /api/now/table/incident\ - Pull incidents with pagination
• \GET /api/now/table/sys_journal_field\ - Pull comments and work notes per incident
• \PATCH /api/now/table/incident/{sys_id}\ - Add comments/work notes back

Testing

• Syntax validation passes
• Module structure follows existing patterns (PagerDuty, Grafana Incident providers)
• All existing topology functionality preserved unchanged