Address screening waivers

Addresses an admin let through screening until a date, newest grant first, with the reason recorded when the waiver was granted. A waiver is granted, extended and revoked through the change log (domain screening-waivers, allowlisted Toolbox session only); this route only reads them. active is false once the end date has passed. Paged like the history reads: address and state apply before paging, so meta.total counts every matching waiver, and meta.offset/meta.limit describe the page returned. Requires the compliance:screening-read capability or an allowlisted platform session. Responses are compliance data: Cache-Control: no-store, never log them. A query parameter this route does not list answers 400 VALIDATION_ERROR.