reorganize incident review questions

This MR is trying to avoid redundancy in incident reviews, by bringing questions into a more logical order and removing some duplicate parts.

• I added a time to detection: part on top of minutes of downtime:, because I think that's an important metric for incidents
• I moved the how was the root cause diagnosed question up into the Incident Response Analysis section above the how did we mitigate question, because diagnosis in most cases happens before mitigation and describing the mitigation thus also needs an explanation of the root cause diagnosis first.
• I removed the second timeline in the incident review section
• I added Did we have other events in the past with the same root cause?
• I added some formatting for better readability

I'm not sure about the usefulness of the 5 Why's section. It's a nice way to describe an incident, but it's also partly duplicating the things that already should have been answered in the Summary and the Incident Response Analysis section. If we want to keep the 5 Why's, maybe we should put them directly under the summary, as it will give the reader a full understanding of the problem which should then help to understand and evaluate the Incident Response Analysis part later.