Feature request: emit first-class SCIM group membership change events

## Problem

Inbound SCIM group membership updates currently produce a generic group `model_updated` audit event. Event Rules and email transports cannot reliably determine which member changed, whether the member was added or removed, or which SCIM source initiated the change.

This makes it difficult to implement useful access-handoff notifications, approvals, or downstream automation for SCIM-managed entitlements without patching the SCIM group endpoint.

## Requested capability

Emit a first-class event after each successful inbound SCIM group membership change. The event should expose structured context for:

- action: `added` or `removed`
- affected user: UUID, username, display name, and email where available
- affected Authentik group: UUID and name
- SCIM source: UUID and name
- the normal HTTP request/audit context

It should be usable by Event Matcher policies and Event Rules, so installations can route a notification to the appropriate group without custom server code.

## Why a generic group-update event is insufficient

A group can receive unrelated metadata changes, and its generic update event does not identify the membership delta. A rule that only matches the group can therefore notify on unrelated changes while still failing to say who received or lost access.

## Scope

This is separate from #24173, which concerns standards-compliant filtered SCIM group-member removal handling. Even when membership updates are applied correctly, a dedicated event is needed for useful native notification and automation.

## Current workaround

We use a narrow, version-pinned server-side patch that emits a `model_updated` event with membership context after a real SCIM membership add/remove. A supported native event would let us remove the notification portion of that patch.

The issue names no files, tests, or entry points. Start by locating inbound SCIM group membership update handling and the existing model_updated audit-event emission, then trace how Event Matcher policies and Event Rules consume events; done means successful membership adds and removals expose the requested structured context and remain usable by those consumers.

Written by the indexing model from the issue text.