fix: Sublime adapter default base URL and unbounded pagination

[pllesperance-lc]

Problem

The Sublime audit adapter is unusable in two ways:

1. The default base URL is never applied. SublimeConfig.Validate() holds the fallback to https://platform.sublime.security, but nothing ever calls it — neither the constructor nor the general runner (containers/general/tool.go). With an empty base_url (which the console suggests works for North America), every request fails with:

http.Client.Do(): Get "/v0/audit-log/events?limit=500&offset=0": unsupported protocol scheme ""

2. Every poll pages through the tenant's entire audit log history. makeOneRequest sent no time filter to the API — it started at offset=0 each 30-second cycle, walked all of history 500 events at a time, and discarded old events client-side. Sublime Cloud tenants have unlimited audit retention, so a high-volume tenant hits hundreds of pages per cycle until a deep-offset query exceeds the 30s HTTP timeout:

http.Client.Do(): Get "https://platform.sublime.security/v0/audit-log/events?limit=500&offset=108000": context deadline exceeded

The failed cycle is then discarded and the next one restarts at offset 0, so the adapter never ships a single event.

Fix

• NewSublimeAdapter now calls conf.Validate(), matching the bitwarden/cylance/proofpoint_tap/trendmicro constructors, so the base URL default (and poll interval default) actually apply. Validate() also trims a trailing slash from base_url.
• Polls now pass created_at[gte]=<watermark minus the existing 30s overlap> (API reference), so the server only returns new events and pagination is bounded by new-event volume instead of all-time history. Event selection semantics are otherwise unchanged (same client-side watermark filter and dedupe).
• In passing: response bodies are closed per page instead of deferred until all pages complete, and the non-200 path returns a real error instead of the preceding call's nil err.

Testing

• Updated TestMakeOneRequestNon200, which pinned the nil-error quirk as current behavior.
• New: TestNewSublimeAdapterValidates (constructor applies base URL default, rejects missing api key), TestMakeOneRequestSendsTimeFilter (polls carry created_at[gte]), TestMakeOneRequestPaginates (full page triggers next offset, results combined), and a trailing-slash Validate case.
• go vet ./sublime/..., go test ./sublime/..., and go build ./containers/... all pass.

🤖 Generated with Claude Code