Add a way to remove a member from the organisation.

The members are moved to a special table to have their accounts closed.
Add a dry-run mode to the member creator where it doesn't attempt to talk to LDAP.
Annotate the membership departure with who approved it when and why.
Remove departing members from LDAP or the appropriate groups.