fix(auth): allow OIDC tokens with non-client audience

[callebtc]

Summary

• stop requiring OIDC access token aud to equal the OIDC client id
• keep issuer/signature/expiry validation and the existing optional azp mismatch rejection
• update auth unit coverage for Keycloak-style aud=account, azp=cashu-client tokens

Tests

• pytest tests/mint/test_mint_auth_server_unit.py
• ruff check cashu/mint/auth/server.py tests/mint/test_mint_auth_server_unit.py
• ruff format --check cashu/mint/auth/server.py tests/mint/test_mint_auth_server_unit.py

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.29%. Comparing base (37d6437) to head (b29cd05).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1065      +/-   ##
==========================================
+ Coverage   75.26%   75.29%   +0.02%     
==========================================
  Files         111      111              
  Lines       12429    12429              
==========================================
+ Hits         9355     9358       +3     
+ Misses       3074     3071       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.