Allow configuring audit trail endpoints per space

Today the audit trail webhook is account-wide: one endpoint for the whole account (docs, config under Audit trail → Configuration).

Spaces already isolate almost everything else: RBAC, VCS integrations, worker pools, cloud integrations, policies. We would like to use a space-per-entity topology for regulatory / conflict-of-interest separation, but for this each entity needs its audit events delivered only to its own immutable sink (SIEM / Object-Lock bucket), under its own keys and access controls.

It would be very helpful if audit trail webhooks could be configured per space (optionally with inheritance to child spaces), so events for resources in space A go only to space A’s endpoint. Account/root-level events could still use a root webhook. Terraform/API parity (space_id on spacelift_audit_trail_webhook) would be ideal.

Related but different: Multiple Audit Trail Configurations asks for multiple account-level endpoints so several teams can ingest the same stream. We need space-scoped delivery so each entity’s sink receives only that space’s events — not a shared fan-out of the full account trail.