List and query Access Analyzer findings

Lists Access Analyzer findings for the active tenant/subscription/project scope. Each finding describes a resource (object bucket, KMS key, IAM role, secret, snapshot, machine image, file share, or database) that an external principal can reach, including the granting policy statement, the access level, and a remediation recommendation. This single endpoint serves both the plain route-load list (default filter status=Active in the UI) and the search/filter/sort/paginate behavior of the iam.access_finding.search_filter_sort action: q matches resource name and external principal, and the status, exposure, resourceType, and accessLevel filters mirror the UI facet chips. Validation: scopeId must reference a scope visible to the caller (NOT_FOUND otherwise); status, exposure, resourceType, accessLevel, sort, order, page, and pageSize must be within their documented enums/ranges or the request fails with VALIDATION_FAILED (422). Async & state: Synchronous read; no state change. Findings themselves are produced by the continuous analyzer scan, not by this call. Errors: 401 when unauthenticated; 403 when the caller lacks a reader-capable role on the scope; 422 on malformed filter/pagination parameters; 500 on backend read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required.