donate: change alerting thresholds for card testing

We have had a couple incidents recently where we had card testing but
those alerts never fired.

I believe the thresholds were not set correctly. First, they were kind
of too tolerant, but also, the `for` mixed with a `rate()` query meant
that we never had the sustained load to trigger the alert.

So, instead, we sample over a longer period (one hour) and remove the
`for` threshold entirely.

We still check only for failed transactions with vendors: added
together, we frequently cross that threshold otherwise, and that's normal.