fix: correct RBAC scopes in incidents API (#5363)

[anxovatomica]

Problem

The RBAC scopes in routes/incidents.py were incorrect:

• delete_incident endpoint used write:incident instead of delete:incident
• Read endpoints (get_incident_alerts, get_future_incidents_for_an_incident, get_incident_workflows) used read:incidents instead of read:incident

This broke the permission model — a role with write permission could delete incidents, and the inconsistent incidents vs incident scope naming prevented proper RBAC configuration.

Changes

• Corrected delete_incident scope to delete:incident
• Unified all read scopes to read:incident

Closes #5363

[anxovatomica]

Following up on this RBAC scope fix. This corrects 4 incorrect scope strings in the incidents API that could cause authorization mismatches. Clean 4-line change, all CI passing.