HTTP API JWT authorizer rejects array aud and matches client_id when aud is present #7652

Problem

The HTTP API (v2) JWT authorizer validates aud differently from API Gateway on AWS in two ways.

1. An array aud is always rejected. parseJwtClaims reads the claim with claims.path("aud").asText(null). For a JSON array, Jackson's asText() returns "", so the audience check compares the configured audience with an empty string and fails. An array aud is valid per RFC 7519 §4.1.3, and API Gateway accepts the token when any entry matches the authorizer's audience list.

Auth0 issues this shape whenever the openid scope is requested, for example ["https://api.example.com", "https://<tenant>.auth0.com/userinfo"]. So an Auth0-backed JWT authorizer can't authenticate any user-login token on Floci, while AWS accepts the same token.

2. client_id is matched even when aud is present. A token with aud: ["other"] and client_id: "expected" passes an authorizer configured with audience ["expected"]. The AWS docs say API Gateway checks client_id only when aud is absent; when both are present, it evaluates aud.

Repro (array aud)

1. Create an HTTP API with a JWT authorizer: issuer = https://<tenant>.auth0.com/, audience = ["https://api.example.com"].
2. Log in through Auth0 with scope=openid ...&audience=https://api.example.com.
3. Call a JWT-protected route with Authorization: Bearer <access token>. Floci returns 401 {"message":"Unauthorized"}.

Scope

• Parse aud as either a string or an array, and match when any configured audience is among its entries.
• Fall back to client_id (Cognito access tokens) only when the token has no aud claim. An aud that is present but empty or has no matching entry is rejected.
• No change to signature, exp, iss or scope checks, or to their order.