POSTing/PUTting incidents, some thoughts for simplifying the glue service

[hmpf]

Currently, when you post to /api/v1/incidents/ you create a new incident and a start event. To change it you POST/PUT events.

• What happens if the exact same incident is posted again? We could have a "repeat" event for these, and combine them into one.
• Then there's how to mark an incident ended. If the same incident but now with end_time is POSTed, that could end the event. We might need a big index for this, but there are fewer fields on incident now, so cheaper.
• As for flapping: if a flap is defined as "everything is the same except for start_time, end_time" then we can use the same lookup to check if this incident already opened and closed within such and such a time-window, and create another incident (source: argus) that flapping is happening.