Audit log `logout` (session delete) endpoint

Followup to #9773 — logout is currently the only API operation that needs audit logging but doesn't have it. This sounds more urgent than it is because sessions are a lot more likely to be deleted due to expiry (an event that is not currently logged because it is not a discrete API operation) than they are to be deleted by a call to logout — any request that comes in with an expired session causes that session to be hard deleted:

https://github.com/oxidecomputer/omicron/blob/10f6883efb4eb5cbaa5a3e8189e8302ab93f548c/nexus/auth/src/authn/external/session_cookie.rs#L134-L138

https://github.com/oxidecomputer/omicron/blob/10f6883efb4eb5cbaa5a3e8189e8302ab93f548c/nexus/src/context.rs#L529-L532

Audit logging logout requires a tiny bit of work because the endpoint does auth in a funny way: we just try to delete a session matching the provided token. If the token doesn't match anything, it's a noop, and the request goes through fine. In order to make logging work we'd probably have to separate the lookup of the session from the delete in order to have a session ID to write down:

1. Look up session by token
2. Log logout call with session ID
3. Delete token
4. Complete log

https://github.com/oxidecomputer/omicron/blob/10f6883efb4eb5cbaa5a3e8189e8302ab93f548c/nexus/src/external_api/http_entrypoints.rs#L8125-L8144

Start with the logout handler in nexus/src/external_api/http_entrypoints.rs at lines 8125-8144, then read the session deletion paths in nexus/auth/src/authn/external/session_cookie.rs and nexus/src/context.rs. Trace how the token lookup and deletion work, preserving the no-op behavior for unknown tokens. Done means logout writes an audit event containing the session ID and completes the deletion flow.