Add audience claim check (#363)

[maia-iyer]

This PR adds a field in the UserManagement config for expected audience:

  # Configure Keycloak as external Authentication server
  UserManagement "KeycloakAuth" {
    plugin_data {
      # issuer - Issuer URL for OIDC
      issuer = "http://host.docker.internal:8080/realms/tornjak"

      # audience - expected value for aud claim in JWT
      # if not included or set, there will be no audience check
      # recommended to ensure JWT was meant for Tornjak Backend resource server
      audience = "tornjak-backend"
    }
  }

If omitted from the config, the server will log a warning and not run audience check at runtime.

closes #363

Also this attempts to clean up some IAM documentation

[mrsabath]

This is a really good addition. Thank you @maia-iyer . I approve assuming it all works end-to-end.

[mrsabath]

good idea to check and print the warning