Fix field path bugs in Okta.Support.Reset and Slack app rules

[arielkr256]

Summary

• [Tuning] Okta.Support.Reset - Wrong path for userAgent condition #2090 Okta.Support.Reset: fix userAgent path — event.deep_get("userAgent", "rawUserAgent") → event.deep_get("client", "userAgent", "rawUserAgent") (top-level field doesn't exist; it's nested under client)
• [Tuning] Okta.Support.Reset - Title names the actor instead of the impacted user #2089 Okta.Support.Reset: fix title() to show the impacted user from target[] instead of actor_user (which always resolves to system@okta.com)
• [Tuning] Slack.AuditLogs.AppAdded - Wrong path for scopes in alert_context #2088 Slack.AuditLogs.AppAdded: fix alert_context() scopes path — entity.scopes → entity.app.scopes (was always returning None)
• [Tuning] Slack.AuditLogs.AppAccessExpanded - Singular details.new_scope field doesn't exist #2087 Slack.AuditLogs.AppAdded + Slack.AuditLogs.AppAccessExpanded: fix severity fallback — details.new_scope → details.new_scopes (singular field never exists; escalation could never fire)

Test plan

• pat test --filter RuleID=Okta.Support.Reset — all tests pass
• pat test --filter RuleID=Slack.AuditLogs.AppAdded — all tests pass
• pat test --filter RuleID=Slack.AuditLogs.AppAccessExpanded — all tests pass
• Pre-commit hooks (fmt + lint) passed

Closes #2087, #2088, #2089, #2090

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes detection logic and severity escalation paths; mis-tuned rules could alter alert volume or miss admin-scope events until validated in tests.

Overview
Corrects wrong deep_get paths in Okta support-reset and Slack app audit rules so matching, alert text, context, and severity behave as intended.

For Okta support reset, the rule now reads user agent from client.userAgent.rawUserAgent instead of a non-existent top-level userAgent, and titles name the impacted user from target[] (User) rather than the actor (system@okta.com).

For Slack app added / access expanded, alert_context pulls scopes from entity.app.scopes, and the admin severity fallback uses details.new_scopes (plural) so High escalation can fire when admin appears only in details.

^{Reviewed by Cursor Bugbot for commit 6cf11a8. Bugbot is set up for automated code reviews on this repo. Configure here.}