Get available scope filter options for a domain app or ARDA.

ACCOUNT_ENTITLEMENT groups are split per entitlement_type_label (e.g. 'Roles', 'Groups'), with each group's items capped at 1000 entitlement labels. Groups whose underlying bucket exceeds the cap set truncated: true so callers know some valid labels are not present in the response.