[#25] - include client allowed audiences in user access token

[https-richardy]

Currently, in the authorization_code flow, the access token issued for the authenticated user does not include the allowed audiences configured on the requesting client.

This causes a mismatch between the client context that initiated the authentication request and the resulting user access token.

When a client requests an authorization code and exchanges it for an access token, the resulting user access token must include all allowed audiences configured for that client.

When client performs the authorization_code flow for this user, the resulting access token must include the client’s allowed audiences.

EXPECTED TOKEN PAYLOAD

{
  "sub": "user_mVScLR2bImhfQXXrjdnHflTiX",
  "client_id": "acme-corp-frontend",
  "aud": [
    "acme-corp-operations",
    "acme-corp-backoffice"
  ],
  "iss": "https://auth.acme-corp.com",
  "exp": 1710000000
}