adding auditevent examples and text

[bwang-icf]

JIRA Ticket:
BB2-4968

What Does This PR Do?

Adds AuditEvent to the swagger documents

What Should Reviewers Watch For?

Anything else missing or any notable differences between the responses given and what is retrievable from the endpoint.

Validation

You will need to obtain a CAN token and then make a GET request to /v3/fhir/AuditEvent as well as /v3/fhir/AuditEvent with a resource id provided. If you're testing this locally, you can disable the client_credentials_validation flag and ensure that the auditevents flag is turned on. Once the auditevents flag is on, you may need to rerun make run-local to ensure the protected capabilities are spun up as well. You will also need to run make collectstatic to see the changes.

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

• Adds any new software dependencies
• Modifies any security controls
• Adds new transmission or storage of data
• Any other changes that could possibly affect security?

• Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
  security engineer's approval.

Any Migrations?

• Yes, there are migrations
  • The migrations should be run PRIOR to the code being deployed
  • The migrations should be run AFTER the code is deployed
  • There is a more complicated migration plan (downtime,
    etc)
• No migrations

[JamesDemeryNava]

My only note here is that adding patient/AuditEvent.rs to a regular auth flow scope param will cause the authorize request to fail with a message like:

Requesting an AuditEvent scope is only valid in token requests through CMS Aligned Networks. For more information, go to this page: https://bluebutton.cms.gov/cms-aligned-networks-documentation/

So does it make sense to not add it as an option here? Unfortunately, I don't think there is an easy way to enable users to actually run AuditEvent calls from the swagger docs page unless we allowed them to run a CAN auth flow. Should we maybe remove the AuditEvent scope from this list, as well as the ability to run an AuditEvent call, as those will not work? At least we have the examples in place so users will know what data to expect. CC @jimmyfagan

[JamesDemeryNava]

Looks good! One question on if we should actually add the AuditEvent scope and the ability to execute those calls.