Get available scope filter options for a domain app or ARDA.

To use these in scope_filters on a create/edit request, copy an item's value (and name) verbatim — value is the machine-matchable identifier, while label is display-only. Posting a label as a value (or any value not present here) is rejected.

ACCOUNT_ENTITLEMENT groups are split per entitlement_type_label (e.g. 'Roles', 'Groups'), with each group's items capped at 1000 entitlement labels. Groups whose underlying bucket exceeds the cap set truncated: true so callers know some valid labels are not present in the response.