feat(api): workload identity in audit logs, additional_tools item in responses, fix ActionSearch.query to be optional.