feat: gate Splunk Cloud writes behind two explicit opt-ins

[JacobPEvans-personal]

Summary

Second of a 3-PR stack replacing #80 (stacked on #83).

• Adds create/update/delete for index, role, and hec-token via Splunk Cloud ACS.
• Every real (non---dry-run) write, on any backend, now requires SPLUNK_ENABLE_WRITES=true. Never a CLI flag, so a saved command line cannot enable one. This is a breaking change for existing Enterprise write callers.
• A Cloud write additionally requires SPLUNK_CLOUD_WRITE=true, and only unlocks the three ACS-writable resources -- enable/disable and every other resource stay refused regardless. This check is enforced even for a --dry-run preview, since it also proves the object is one of the three ACS-writable resources.
• --dry-run itself needs neither variable and sends nothing, on either backend.
• A separate SPLUNK_ACS_WRITE_TOKEN can scope the write auth apart from the read token.
• New Splunk Cloud Write Canary GitHub Actions workflow: workflow_dispatch only, a typed confirm=WRITE input, a tests: splunk cloud write HEAD commit-subject requirement, and a protected splunk-cloud-write environment with required reviewers gating the destructive half. It runs the Cloud read canary first, so one approved dispatch is the full read-then-write end-to-end check. With no secrets configured it stops and runs nothing.
• Simplified the ACS write layer from three parallel per-resource declarations (nine wrapper functions, a path tuple, a dispatch dict) down to one WRITABLE table plus one cloud_write() function.

Test plan

• ruff check ., ruff format --check ., pyright, pytest (1251 passed) all green locally
• pre-commit run --all-files and the pre-push stage (adds pytest) both green
• New tests/unit/test_write_gating.py: every write leaf refuses without SPLUNK_ENABLE_WRITES on Enterprise; every write leaf refuses on Cloud without SPLUNK_CLOUD_WRITE; the nine ACS-writable leaves reach a mocked ACS transport once opted in; everything else stays refused even when opted in; --dry-run needs neither variable on Enterprise
• Human: add the splunk-cloud-write GitHub Environment with required reviewers, and its secrets (SPLUNK_URL, SPLUNK_ACS_WRITE_TOKEN, SPLUNK_ACS_STACK, optional SPLUNK_ACS_BASE_URL, SPLUNK_TOKEN), once ready
• Dispatch Splunk Cloud Write Canary on a non-production stack; confirm the read half is clean, the write half asks for approval, and no vct_ci_* object is left over

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.