fix(jwt): preserve verify() defaults with audience validation

[swalker326]

Summary

• validate JWT audience during client.verify() and preserve backward compatibility by defaulting expected audience to clientID when options.audience is not provided
• add focused regression coverage for audience validation and refresh-path behavior, and update existing tests to assert explicit/implicit audience expectations
• improve /userinfo invalid token handling with consistent 401 invalid_token responses and add a regression test

Notes

• Supersedes fork/pr 309 jwt audience validation #20
• Credits upstream work from Security: Implement RFC 7519 Compliant JWT Audience Validation anomalyco/openauth#309 by @execute008 (Oskar Freye)