Add option to require a valid aceess token audience

[ragnard]

Description

Add a config option to require OAuth2 access tokens to have an aud claim.

Previously, a null audience was always added as a valid audience, meaning that an access token without the aud claim would be accepted.

This behaviour is not always desirable. This change introduces a new config option:

• http-server.authentication.oauth2.require-audience=true/false.

If false (default), the behaviour is as before this change. If true, access tokens without an aud claim will not be accepted.

Additional context and related issues

Similar issues have been raised before:

• OAuth2: Trino validates OAuth2 token with null audience claims when additional-audiences configured #21239

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(x) Release notes are required, with the following suggested text:

## Section
* Add OAuth2 configuration option to require an `aud` claim.