[Feature]: API clients can filter service offerings and brokers by guid and space

[norman-abramovitz]

Blockers/Dependencies

None.

Background

As an API client (a web console — Stratos — rendering marketplace/broker views)
I want GET /v3/service_offerings to support service_broker_guids and space_guids, and GET /v3/service_brokers to support space_guids
So that I can show a broker's offerings and space-scoped marketplace content without resolving broker names first.

Currently ServiceOfferingList supports names, service_broker_names, fields[service_broker], order_by, page, per_page and ServiceBrokerList supports names, order_by, page, per_page; the guid- and space-based filters are rejected with CF-BadQueryParameter. Cloud controller supports service_broker_guids/space_guids on offerings and space_guids on brokers per the v3 API docs. Related to #3591 (same class of gap on service_credential_bindings) and follows on from the filter work in #3271/#3881.

Name-based filtering (service_broker_names) works today, so this is a convenience/parity gap rather than a hard blocker — but guid-based joins are what clients naturally hold after listing brokers.

Acceptance Criteria

GIVEN a broker B with offerings exists
WHEN I GET /v3/service_offerings?service_broker_guids=<B-guid>
THEN I receive exactly B's offerings

GIVEN brokers exist (globally or space-scoped)
WHEN I GET /v3/service_brokers?space_guids=<S-guid>
THEN I receive the brokers visible in S

Dev Notes

Filter allowlists live in api/payloads/service_offering.go and api/payloads/service_broker.go.