[18.0][IMP] auth_jwt: allow more authorization options over aud

[dnplkndll]

@kobros-tech can you add some tests?

probably want to require one of the possible types too. so maybe a type selection [aud,scope,group] then the aud_text to use to parse the match value?

need to rebase after: #752 merges

or

[dnplkndll]

@sbidoul working aws cognito as a token provider, there are no aud. but we do have scopes and user groups. would it be useful to replace the aud with these new tests to validate a server to server account has proper scope or a user has a group? the tests are pretty sloppy ( any intersection of the sets) can refine if useful. another option might be a simple disable but really do need the scope test in our case.
The next issue is we would have tokens that have sub and map user/partner via oath provider data? I guess that can be done in partner_id_strategy extension.

server-auth/auth_oidc/models/res_users.py

Line 72 in 035093d

validation["user_id"] = validation["sub"]

[sbidoul]

I'm ok to make audience optional. May I suggest doing that in an independent PR to facilitate review?

Then adding validation on additional claim sounds ok too. I would not override the meaning of the audience field, though. How about an expected_claim field containing a literal dictionary (to be parsed with ast.literal_eval) or a json field.

[dnplkndll]

optional aud only
#755