feat(opencti): new OpenCTI threat-intelligence integration

Add a marketplace integration for the OpenCTI platform (GraphQL API,
compatible with OpenCTI 5.x/6.x), built on the Python pycti client and
run from a remote engine.

26 commands: observables (list/create/delete/field update/add/remove),
indicators (list/create/update/field add/remove, types), incidents
(list/create/delete, types) with an OCSF ingestion mapper, relationships
(list/create/delete), and reference data (organizations, labels, marking
definitions, external references).

- Ingestion: get_incidents to an OCSF finding mapper + an OpenCTI Incident type.
- Auth: user API key (Bearer) via pycti; requires pip install pycti on
  the engine host.
- Scripts are self-contained (INTEGRATION_SECRETS/INTEGRATION_INPUTS in,
  JSON out) following the established marketplace pattern.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/opencti/mappers/get_incidents.yaml

@@ -0,0 +1,18 @@
+name: "OpenCTI Incidents → OCSF"
+description: "Maps an OpenCTI incident (get_incidents, results_path = entities) to OCSF finding fields. Each entity is a normalized incident object emitted by the get_incidents script."
+field_mappings:
+  title: "name"
+  severity: "severity = 'critical' ? 5 : (severity = 'high' ? 4 : (severity = 'medium' ? 3 : 2))"
+  description: "description"
+# results_path = entities; source_path is JSONata over ONE incident object.
+# Paths absent from a given incident are skipped at ingestion, so extra entries are safe.
+ocsf:
+  # ── Finding ───────────────────────────────────────────────────────
+  - { source_path: "id",            ocsf_field: "finding_info.uid" }
+  - { source_path: "name",          ocsf_field: "finding_info.title" }
+  - { source_path: "description",   ocsf_field: "finding_info.desc" }
+  - { source_path: "created",       ocsf_field: "finding_info.created_time" }
+  - { source_path: "updatedAt",     ocsf_field: "finding_info.modified_time" }
+  - { source_path: "incidentTypes", ocsf_field: "finding_info.types" }
+  - { source_path: "objective",     ocsf_field: "message" }
+  - { source_path: "confidence",    ocsf_field: "confidence_score" }