Include requiresRequest flag for searchAsRoles requests

[avatus]

This PR is the start of a series that will allow users to make access requests directly from the resources page in the web UI.

The purpose of this PR is to add a flag to differentiate between resources being returned due to static access, and resources returned during an "extended" auth context (for a searchAsRoles) request.

The second part of this series will be appending this RequiresRequest value to all of the makeResource methods for the resources returned to the web UI. I decided to leave that out of this PR so the focus could be on the method I'm proposing to differentiate between the two types of access.

changelog: Audit events for AccessRequestResourceSearch are no longer emitted.

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[avatus]

After fiddling with this a bit, I think instead of checking if searchAsRoles exists in the request, I'll have to add a new field like includeRequestable. This will help with backward compatibility and also allow us to do something like "get searchAsRoles, get only have access, or both".

If a new web client calls an old proxy with searchAsRoles, it will receive all the resources (including requestable) but without the distinction between which is which, the new web client will display all as "has access". However, if we add the new field, then the old proxy will essentially ignore it and will only receive has access resources. I believe for backward compatible in this case, NOT seeing requestable resources is better than seeing resources that you think you have access to (during the upgrade).

Also, if an old web client hits a new proxy, it won't send the new param anyway and everything will be as expected.

I will update the PR with this new field and then address the current feedback (that doesn't care about the param name)

[nklaassen]

Looks pretty good to me, I would approve but I don't see any tests for this, will you be adding some?

[avatus]

will you be adding some?

Yup, just added. thanks for the detailed feedback!

[rosstimothy]

Only populated ..... ?

[rosstimothy]

add a comment to this field too?