Reject Authentik OAuth id_tokens issued for another client

[rjgoyln]

Summary

_validate_jwt decodes the Authentik id_token with authlib and calls claims.validate()
without passing claims_options. authlib's validate_aud returns early when no aud option
is supplied, so the audience is never compared against our own client_id, even though OIDC
requires an ID Token's aud to contain the client id it was issued to. This pins the audience
at the decode site, and the issuer where it is configured.

Changes

• _validate_jwt takes an optional claims_options and forwards it to authlib_jwt.decode().
  It defaults to None, so existing callers and subclass overrides behave as before.
• _get_authentik_claims_options() pins aud to the registered client_id. client_id is
  always available, and per OIDC an id_token must carry it, so this holds for any compliant IdP.
• iss is only checked when issuer is present in server_metadata, otherwise a warning is
  logged. Deployments that configure jwks_uri alone are a valid existing setup and keep working.
  Happy to make it mandatory instead if reviewers prefer that trade-off.
• Tests sign real tokens with an RSA keypair and run the full path — accepted token, wrong
  audience, audience list without our client, unexpected issuer, missing claims, and the
  unconfigured-issuer fallback.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  generated-by: Claude Code (Opus 5)

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.