Fix misleading IP address in audit

- Previously when members were removed from a group
  via SCIM the member's last know IP address was
  used int he audit event making it seem as though
  the member removed themselves whereas it is actually
  done via SCIM.
  https://docs.gitlab.com/ee/development/internal_api/index.html#instance-scim-api

- Refs: https://gitlab.com/gitlab-org/gitlab/-/issues/259159

Changelog: fixed
EE: true

Add spec for destroy audit