feat(crowdstrike): add alerts, host response, IOC, Spotlight, RTR, and case tools - #6746

…d case tools

CrowdStrike Falcon shipped only three read-only Identity Protection sensor
tools. This adds 20 tools across the response and investigation surface SecOps
teams actually automate against.

Alerts (current Alerts API): query, get details, update status/assignment/
tags/comment/visibility. Hosts: contain, lift containment, hide, unhide. Host
groups: query, get details, add/remove hosts. IOC Management: query, get, create,
update, delete. Spotlight: query vulnerabilities, get vulnerability details. Real
Time Response: init session, execute a read-only command, poll command status,
delete session. Case Management: query cases, get case details.

Every endpoint, request field, and response field is taken from CrowdStrike's
published surface (developer.crowdstrike.com API reference, FalconPy endpoint
definitions, and the swagger-generated gofalcon models). Required API scope is
documented in each tool description.

Deliberately not implemented:
- Detects API: decommissioned 2025-09-30, superseded by Alerts.
- CrowdScore Incidents API and behaviors: decommissioned 2026-03-09 and removed
  from the developer center entirely. Case Management is CrowdStrike's
  replacement, so its two documented read operations are implemented instead.
- Case create/update/merge: the swagger types case `status` and
  `severity_info.level` as bare strings with no enum, so a correct write cannot
  be built without guessing.

CrowdStrike answers 200 with a populated `errors` array for partial failures.
Responses now surface those per-item errors, and an empty result set carrying
errors is reported as a failure rather than silently succeeding.

The route's shared Falcon client, response normalizers, and operation dispatch
move into colocated modules so the handler stays readable at 23 operations.

…uard IOC pagination

Falcon can answer 200 with an errors array and no resources. The detail
operations already treated that as a failure, but the five query branches
returned an empty successful result, so a failed alert query read as a valid
no-match to the calling workflow.

Blank FQL rejection now covers the alert, host-group, indicator, vulnerability,
and case contracts too, not just sensors, and Query Indicators rejects offset
combined with after instead of forwarding a pagination pair CrowdStrike refuses.

…ropped output docs

The executor merges `tools.config.params` over the raw block inputs, so a key the
mapper omitted kept its raw subBlock value — and an untouched subBlock is stored
as `null`, which the route contract rejects. Query Alerts with an empty Filter,
Update Alerts without every optional field, and Delete Indicators without an
audit comment all 400'd before reaching CrowdStrike. Seed every optional key as
`undefined` so omission is authoritative, which also stops a value left over from
another operation riding along.

Shared output consts in `outputs.ts` were silently dropped from the generated
docs: the generator scans tool source and resolves consts only from `types.ts`,
so `errors`, `affected`, and `pagination` rows vanished from 17 tool pages and
every nested property row with them. Inline the literals.

Against CrowdStrike's own generated SDKs and developer portal:
- add csrutil, ifconfig, users, and the eventlog subcommand forms to the
  read-tier RTR base commands, matching PSFalcon's ValidateSet
- add detection_suppress/detection_unsuppress and cap host actions at the
  documented 100 ids
- cap the IOC search limit at the documented 500, not 2000
- correct the Cases scope to "Cases: Read"; case-templates guards a different
  collection
- type the IOC payload so a blank string cannot clear a stored field on PATCH
- send `MsaRangeSpec` bounds capitalized, as the spec serializes them
- fail the sensor and RTR-session-close paths on a 200 whose envelope carries
  only errors, and surface partial sensor errors
- give Delete Indicators its own filter so a stale alert query cannot widen it
- drop the pre-selected network-isolating host action

…and US-3 region

Independent re-validation against gofalcon's swagger-generated models and
CrowdStrike's developer center turned up several wire-level errors.

- Real Time Response advertised "eventlog backup"/"export"/"list", "reg query",
  ifconfig, and users as base commands. base_command names a command family and
  subcommands belong in command_string; the eventlog write variants are Active
  Responder commands that would fail on scope under this Read-scoped tool, and
  ifconfig/users appear in neither authoritative list. The block now offers the
  16 documented read-tier families and the contract enforces them.
- Indicator updates accepted an entry with no id, which cannot name a record,
  and accepted type/value, which the update model does not expose. Creates
  accepted an entry with no type, value, or applied_globally -- the one property
  CrowdStrike marks required, and the one that decides fleet-wide scope.
- CrowdStrike documents that PATCH overwrites any omitted field with a blank
  value. The contract can only catch blanks, so the update tool now tells the
  caller to read the indicator first and resend its full field set.
- Added the US-3 commercial region, which was missing from every cloud list.
- Aggregate queries silently dropped percents and filters_spec.
- Deleted the response-envelope body unwrap: no endpoint this integration calls
  returns that shape, and getFalconErrorMessage never honored it anyway.
- Softened the Detects and Incidents claims to what the sources actually state.

A tool description longer than the docs generator's 600-character id-search
window silently publishes as an empty string; three descriptions had crossed it.
Shortened them and added a test that fails before the catalog goes blank.

… the sensor tools

The three sensor tools were the only ones in the family that named neither their
endpoint nor their OAuth2 scope, and none of them said these are the domain
controllers Falcon Identity Protection monitors rather than Falcon endpoint
sensors -- a distinction an agent choosing between them and the Hosts tools has
no other way to make. Identity Protection Entities: Read is also a separate
product entitlement from Hosts and Alerts.