Add event logs for security audit purposes

To satisfy HECVAT HLAA-07, add audit logs that include AT LEAST all of the following; login, logout, actions performed, timestamp, and source IP address.

Note: we may exclude source IP address for events performed by participant accounts on the grounds that we currently avoid storing these *in order to protect participant privacy*. Security threats are much more likely to come from accounts with Researcher level permissions or higher, because these accounts can have broader access to multiple participants' information.

Current status: We do not yet have full audit logs available that store actions from a given session together, although we can view all requests to the server to e.g. see when a given view or API endpoint was accessed. This is something we will be working to implement. We do have audit logs including IP addresses of all actions taken on the videos stored on S3.

--

**Narrative**
How will this help developers do their job better?

"As a Developer, I want to be on the most recent version of Python so that I can use [xyz] new feature"

**Acceptance Criteria**
A precise description of how/when this issue will be considered closed, e.g.:

- [ ] Tests
- [ ] Scoping
- [ ] Alternatives Considered
- [ ] Rico sign-off

**Implementation Notes**
Leave important notes/suggestions here for implementation (important files, suggested approaches, etc.)

Begin by reviewing the existing server request/API endpoint logging and the audit logs for video actions stored on S3. Clarify the session-level event model and scope with maintainers; done should cover login, logout, actions, timestamps, and the applicable source IP addresses, with tests and sign-off defined.

Written by the indexing model from the issue text.