Add data collection access logging app

[kvo3]

Adds a new Workbench devcontainer app for auditing data collection access grants. The app is a Flask web application that queries BigQuery monitoring tables (workbench-bq-log-sink) to provide visibility into who has access to a data collection, how they got it (directly or via group membership), and when.

Views

• Forensic: Data Collection (landing page) — Full history of access grants for a data collection. Shows GROUP, MEMBER, and INDIVIDUAL grants with role,
  timestamp, and actor. Group rows are expandable to show who was in the group at the time of the grant. Supports hiding revoked access and toggling between
  user-facing and internal group names.
• Group Membership Audit — Full grant/revoke history for a Workbench group, with a "current members only" filter.

Features

• Configurable org and environment via env vars, config.yaml, or auto-detected from wb workspace describe
• Org override field on all views for cross-org lookups without restarting the app
• Search values persist across tab navigation
• Client-side table filtering (AND/OR keyword search), column sorting, column-level filters, and resizable columns

Infrastructure

• Dockerized with docker-compose.yaml and .devcontainer.json for Workbench devcontainer deployment
• Python 3.11 slim base image, Gunicorn with 2 workers / 4 threads
• .gitignore added to exclude .venv/, pycache/, and .env files

BENCH-8927

[emmarogge]

LGTM!