add client_id claim and make aud the command_endpoint

[dickhardt]

Change the aud to be the endpoint the command is being posted to, and put the client_id in a client_id claim. Assuming the client_id is not the same as the endpoint, this will reduce the risk of confusing a command token with an id token.

[dickhardt]

see thread starting at https://lists.openid.net/pipermail/openid-specs-ab/2025-March/010680.html