feat(slack): Add native Seer write approvals (#122497)

Add native Reject and Approve controls when Seer requests write access
from a Slack conversation. The action handler verifies the linked,
active Sentry user, active organization integration, run ownership,
exact pending input, and grantable scopes before resuming Seer, then
replaces the original card with its final status.

This keeps the approval inside Slack and uses the existing Seer
notification renderer to produce Block Kit instead of handing off to the
browser. Approval messages cache the pending input ID so a stale card
cannot act on a later request in the same run. The button payload
remains safe for rolling deploys because older pods treat it as a link
click and no-op; rejecting remains available if the feature is later
disabled, while approving still requires the agent-token feature.

The existing browser approval flow is unchanged.