chore: refactor request models to include scope

[markphelps]

• adds scope to request model to aide in authz, as we will be 'scoping' authz policies to be at the namespace, flag, segment, and token levels. ie we wont support policies where you can update a flag but not a variant since variants are 'nested' under flags
• if no scope is present, then we will fallback to the subject for authz
• move past tense logic for audit events into the part of code that creates audit events
• get rid of un-needed audit event custom marshaller
• adds namespaced interface to requestor as we'll need to be able to get the namespace of the request for future RBAC support

I initially was going to have the Request also know how to 'create' it's own audit event, however I realized this wasn't really possible since the majority of audit events include the entire object / structure after the response has already been constructed, which we wont have at 'request time'

[GeorgeMac]

Looks good. I am going to merge it in so I can make the changes to the policy language on this.