fix!: Verify audience claim matches client ID for OpenID provider

[SanjayVas]

This addresses a bug in #288

The client ID is generated by the OpenID provider on registration, so the OpenID provider configuration needs to include the client ID.

[wfa-reviewable]

This change is 

[stevenwarejones]

Reviewed 2 of 3 files at r1, all commit messages.
Reviewable status: 2 of 3 files reviewed, 1 unresolved discussion (waiting on @SanjayVas)

---

src/test/kotlin/org/wfanet/measurement/common/grpc/OpenIdConnectAuthenticationTest.kt line 78 at r1 (raw file):

  @Test
  fun `verifyAndDecodeBearerToken throws UNAUTHENTICATED when audience does not match`() {

why is this test not needed?

[SanjayVas]

Reviewable status: 2 of 3 files reviewed, 1 unresolved discussion (waiting on @stevenwarejones)

---

src/test/kotlin/org/wfanet/measurement/common/grpc/OpenIdConnectAuthenticationTest.kt line 78 at r1 (raw file):

Previously, stevenwarejones (Steven Ware Jones) wrote…

why is this test not needed?

Done. Figured out a different way to test it.

[stevenwarejones]

Reviewed 1 of 1 files at r2, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on @SanjayVas)