Support additional claims in JWT (particularly sub)

[mebaran]

Right now, the JWT infrastructure only supports a hardcoded set of claims (aud, iss, etc.). I would like to add the sub field to this list in order to support Google service accounts better. Here is a Google page that provides some context: https://developers.google.com/identity/protocols/OAuth2ServiceAccount.

[hadley]

I'd rely appreciate it if you had time to check to make sure this works for you!