Audit Log: group sub-types under scope filter (DEPLOYMENT_TOKEN/POLICY/REVISION, session apps, etc.)

## Problem

The audit log scope filter only matches the primary type (e.g. `DEPLOYMENT`) but not its sub-types (`DEPLOYMENT_TOKEN`, `DEPLOYMENT_POLICY`, `DEPLOYMENT_REVISION`). Similarly, the session scope does not surface session-app-related events.

These sub-type enum values exist in the schema but are silently excluded when users filter by the parent scope, causing confusing gaps in audit history.

## Proposed Fix

1. **Group deployment sub-types under the deployment scope**: selecting the deployment scope should include `DEPLOYMENT`, `DEPLOYMENT_TOKEN`, `DEPLOYMENT_POLICY`, `DEPLOYMENT_REVISION`, and auto-scaling rule events.
1. **Group session sub-types under the session scope**: selecting the session scope should include `SESSION` and session-app-related events.
1. **Add a type sub-filter within each scope** so users can optionally drill down to a specific action type.

## References

Schema enum values (confirmed in `data/merged_schema.graphql`):

- `DEPLOYMENT_TOKEN @join__enumValue(graph: STRAWBERRY)`
- `DEPLOYMENT_POLICY @join__enumValue(graph: STRAWBERRY)`
- `DEPLOYMENT_REVISION @join__enumValue(graph: STRAWBERRY)`

## Notes

Captured while working on branch: fix/FR-3141-revision-image-arch

Related to FR-3044 (deployment-scoped audit log tab) and FR-3041 (session-scoped audit log tab).

JIRA Issue: FR-3145