Update private key JWT audience logic for PAR endpoint

[brockallen]

To allow for issuer name, token endpoint, and/or PAR endpoint.

https://datatracker.ietf.org/doc/html/rfc9126#section-2

[brockallen]

Due to historical reasons, there is potential ambiguity regarding the appropriate audience value to use when employing JWT client assertion-based authentication (defined in Section 2.2 of [RFC7523] with private_key_jwt or client_secret_jwt authentication method names per Section 9 of [OIDC]). To address that ambiguity, the issuer identifier URL of the authorization server according to [RFC8414] SHOULD be used as the value of the audience. In order to facilitate interoperability, the authorization server MUST accept its issuer identifier, token endpoint URL, or pushed authorization request endpoint URL as values that identify it as an intended audience.

And CIBA endpoint

[brockallen]

Moved to 7.0 for when we add the PAR endpoint.

[josephdecock]

This was finished in #1424.