feat(integrations): declare default ingestion (command, mapper, default type)

cortex-xdr, crowdstrike, harfanglab and splunk now ship an `ingestion` block
(fetch command + bundled mapper + default incident type) and a bundled default
incident type under incident-types/, so the instance Collect section is pre-filled
on first configuration and the default type is created on install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/splunk/manifest.yaml

@@ -277,3 +277,8 @@ commands:
       properties: {}
       required: []
     outputs_schema: { properties: {} }
+
+ingestion:
+  command: search
+  mapper: search
+  default_incident_type: "Splunk Notable"