[dtwersky]

Summary

• The alert action logged to slack_modalert.log, a name the UCC alert base class hard-codes. Splunk_SA_CIM routes every *_modalert.log to cim_modactions, so with CIM installed the app's logs left _internal. It now logs to slack_alerts_alert.log.
• Adds default/props.conf: the slack_alerts:log sourcetype for all the app's logs, with explicit line breaking, so tracebacks stay one event, and millisecond timestamp parsing.
• Bumps to 3.1.1, with an upgrade note on what to search.

Fixes #70

Test plan

• Unit suite passes. The new tests fail against the old name and against a hook without the override.
• Live with CIM 8.5.0 on Splunk 10.2.4 (Python 3.9), 10.4.3 and 10.6.0.5 (Python 3.13): both logs land in _internal as slack_alerts:log, nothing new goes to cim_modactions, a multi-line traceback indexes as one event, and _time matches the raw timestamp.
• AppInspect precert, Splunk Cloud tags: 0 failure, 0 error.
• CI AppInspect workflow passes on the PR.