Restore sessionId absence assertion in audit log helpers

Add WebAuthenticationDetails case to extractRemoteAddress switch so
TokenEndpointAuthenticationFilter's plain WebAuthenticationDetails
contributes its remote address to the audit origin instead of falling
into the default branch and emitting a spurious WARN per event.

Use Optional.of (not ofNullable) for WebAuthenticationDetails.getRemoteAddress()
which carries a non-null contract under JSpecify @NullMarked.

Restore .doesNotContain("sessionId") guards in assertLogMessage and
assertGroupMembershipLogMessage so regressions that leak session or
token fields into audit origins are caught by the test suite.

Author: gdgenchev

uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/audit/AuditCheckMockMvcTests.java

@@ -1392,12 +1392,14 @@ private void assertLogMessage(String actualLogMessage, AuditEventType expectedAu
         assertThat(actualLogMessage).startsWith(expectedAuditEventType.toString() + " ")
                 .contains("principal=%s,".formatted(expectedPrincipal))
                 .contains(" ('%s'): ".formatted(expectedUserName))
-                .contains(", identityZoneId=[uaa]");
+                .contains(", identityZoneId=[uaa]")
+                .doesNotContain("sessionId");
     }
 
     private static void assertGroupMembershipLogMessage(String actualLogMessage, AuditEventType expectedEventType, String expectedGroupDisplayName, String expectedGroupId, String... expectedUserIds) {
         assertThat(actualLogMessage).startsWith(expectedEventType.toString() + " ")
-                .contains("principal=%s,".formatted(expectedGroupId));
+                .contains("principal=%s,".formatted(expectedGroupId))
+                .doesNotContain("sessionId");
 
         Pattern groupLogPattern = Pattern.compile(" \\('\\{\"group_name\":\"" + Pattern.quote(expectedGroupDisplayName) + "\",\"members\":\\[(.*?)]}'\\): ");
         Matcher patternMatcher = groupLogPattern.matcher(actualLogMessage);