Fix 500 on unauthenticated group members CSV export

What does this MR do and why?

Anonymous requests to a public group's members CSV export endpoint (/groups/*group_id/-/group_members/export_csv) raised NoMethodError: undefined method 'can?' for nil and returned a 500.

This happens because:

• Groups::ApplicationController skips authenticate_user!, so anonymous users can reach group controllers for public groups.
• export_csv is listed in admin_not_required_endpoints, so the nil-safe authorize_admin_group_member! before_action does not run for it.
• The inline permission check called current_user.can?(...) directly, which raises when current_user is nil.

This MR applies the minimal fix proposed in the issue: use safe navigation (current_user&.can?) so unauthenticated requests get a 404 instead of a 500. A request spec covering the unauthenticated case is included.

References

• #613427 (closed)
• Endpoint introduced in !66755 (merged)