Audit log: include GET endpoints in the audit log

The audit log right now only tracks state-changing operations (POST), and it does not include read-only operations (GET), such as listing resource details. Including those read-only endpoints in the audit log will be important for some customers. Things like resource names and the audit log itself are, or can be, considered sensitive information, and so users getting that information may considered to have relevant security implications, and therefor needed / expected in the audit log. Additionally, this information can be useful for modeling typical user behavior, where some customers maybe want to build signals from in order to detect anomalous activity.

No files or tests are named. Start by locating the audit-log handling for POST operations and the GET endpoint definitions, then determine how read-only requests should be recorded. Done means relevant GET operations, including sensitive resource reads and audit-log reads, appear in the audit log with sufficient request context.