[SebastienLaurent-CF]

✨ Add optional audience parameter for token requests

Why

Some providers need an audience (or API identifier) on the token request to issue an access token for a given API. Without it, Auth0 returns an opaque token instead of a JWT, or rejects the Client Credentials request. Okta custom authorization servers and some Keycloak setups also rely on it. authk had no way to send this parameter.

What

• Config: new optional oidc.audience field (CUE schema + OIDCConfig).
• Client Credentials flow: the audience is sent through clientcredentials.Config.EndpointParams.
• Password flow: oauth2.Config.PasswordCredentialsToken does not accept extra parameters, so a dedicated passwordCredentialsToken sends the request when an audience is set. It:
  • supports basic, post and none (public client) auth methods
  • keeps refresh_token, expiry and id_token (token extras)
  • returns *oauth2.RetrieveError on error, like the library
• Refresh: unchanged; providers keep the audience of the original grant.
• Docs: audience added to the README config example, plus a new Auth0 example.

Configs without audience keep using the library code path, so their behaviour is unchanged.

Example

oidc: {
        issuerUrl:    "https://my-tenant.eu.auth0.com/"
        clientId:     "my-client"
        clientSecret: "my-secret"
        audience:     "https://api.example.com"
}

Tests

- TestClient_GetToken_Audience: Client Credentials, and Password with basic, post and public client auth; checks the audience is sent, client credentials, scopes, expiry, id_token extra, and an error response mapped to RetrieveError.
- TestLoad_Audience: the field is loaded from the CUE config.
- go test ./... passes.

Notes

- Based on feat/public-client: merge that one first, or retarget this PR to main once it is merged.
- Out of scope: the CUE schema still rejects client_secret_basic and client_secret_post for authMethod, although the Go code accepts them