Add custom auditing for expected workspace sharing and auth domain group membership

[amstilp]

We have certain expectations about who workspaces should be shared with and who should be members of the auth domain at different parts of the upload cycle. Add custom audits to verify that this is the case, at least for upload workspaces and combined workspaces.

[amstilp]

See steps for ending an upload cycle: https://docs.google.com/document/d/1nwz7dwxscirJiUq4UGjFQ8cIv9Q9CtmJry9L8f-p97Q/edit?pli=1