Add audit log feature for recording all actions

Adds audit logging that records all authorized actions performed by
users and API keys. The audit log is automatically populated whenever
the authorizer approves an action, and is queryable via GraphQL, MCP,
and CLI interfaces. Permission checks are excluded via a dry-run flag
to avoid phantom entries on page loads.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/authz/authorization.go

@@ -41,7 +41,13 @@ func WithAttr(key, value string) AuthorizeFuncOption {
 // Example: on the viewer memberships page, we're accessing several organization names, but the viewer isn't assuming one yet.
 func WithSkipAssumptionCheck() AuthorizeFuncOption {
 	return func(params *iam.AuthorizeParams) {
-		params.Session = nil
+		params.SkipAssumptionCheck = true
+	}
+}
+
+func WithDryRun() AuthorizeFuncOption {
+	return func(params *iam.AuthorizeParams) {
+		params.DryRun = true
 	}
 }