All security_monitoring_rules fail to sync: cases.condition is stripped from the create payload

Inizia da datadog_sync/model/security_monitoring_rules.py, in particolare alle righe 26–46 e 114–123. Traccia come viene usato excluded_attributes sia per il diffing sia per i payload di create/update, e controlla il parsing della risposta 400 rispetto al body documentato {"error": {...}}. Il lavoro è completato quando cases.condition viene mantenuto nei payload, il messaggio di validazione di Datadog viene conservato e vengono soppressi solo i diff di condition previsti.

Syncing security_monitoring_rules fails to create every non-default rule that has case conditions. There are two compounding bugs:

1. Masking bug: the 400-handling code does error_obj["errors"], but the API error body uses a different shape, so it raises KeyError: 'errors'. That KeyError replaces the real Datadog message, and the log only shows a useless message.

https://github.com/DataDog/datadog-sync-cli/blob/8d60e76de196adf61463e453a4d8a33df296b795/datadog_sync/model/security_monitoring_rules.py#L114-L123

Example output:

2026-06-25 16:33:22,449 - ERROR - [security_monitoring_rules - xxx-xxx-xxx] - 'errors'

The body is {"error": {...}}, not the {"errors": [...]} the code assumes. Once I fixed this bug locally, I found the real bug

2026-06-25 16:59:31,955 - ERROR - [security_monitoring_rules - xxx-xxx-xxx] - 400 Bad Request - {"error":{"code":"InvalidArgument","message":"Invalid rule configuration","details":[{"code":"InvalidArgument","message":"Query a must be used at least once in a case","target":"cases"},{"code":"InvalidArgument","message":"Case condition cannot be empty","target":"cases[0].condition"}]}}

2. Root cause: "cases.condition" is listed in excluded_attributes. Excluded attributes doesn't only affect diffing, but also it is stripped from the create/update payload too. Since condition is required by the rule API, every create is rejected with HTTP 400.

https://github.com/DataDog/datadog-sync-cli/blob/8d60e76de196adf61463e453a4d8a33df296b795/datadog_sync/model/security_monitoring_rules.py#L26-L46

I can bypass this second bug by removing the cases.condition from the excluded attributes, which allows me to create the resources at the new account

Note: simply removing cases.condition from excluded_attributes fixes creation but may reintroduce the spurious diffs that #311 was trying to suppress (the API computes condition for some rule types, e.g. anomaly). The two concerns should be decoupled: keep condition in the payload, but ignore it in the diff via DeepDiff exclude_regex_paths (exclude_paths as used by excluded_attributes doesn't match list indices like root['cases'][0]['condition']).