JWT IdP validation improvements and client_id verification

Fixed JWT IdP token validation to always check exp and iat claims, added client_id verification during code exchange and refresh token flows, and improved JWT IdP audience management and validation.

Source: original entry ↗