Consider allowing subject_token without aud claim to be exchanged

[tommytroen]

When using access_token from IDPorten as subject_token we now get a JWT without aud claim, this fails when validated in tokendings. Consider allowing tokens without aud to be validated.

Investigate and discuss consequences before implementing.

[ybelMekk]

• Maskinporten as issuer do not provide sub and aud in JWT body, the external client must specify those claims explicitly.
• Add ability to configure validation of claims for subject_token for each issuer.
• This is to introduce more flexibility
• To achieve the goal of a test rig for TokenX (including digdirator, jwker and digdir integration).

[ybelMekk]

Finished?

[ybelMekk]

Seems like this can be closed, the issue is take care of, and maskinporten exchange of token is another issue