fix(security): scope the verified-token cache to its middleware instance

The verified-token cache is one process-wide cache keyed by the raw
token. A verdict stored by one middleware instance satisfied any other
instance, so a token valid for one client or audience skipped the
issuer, audience and signature checks on another route. Each instance
now prefixes keys with its provider, client ID and audience. Dynamic
client registration updates the prefix.

main.go

@@ -548,6 +548,7 @@ func NewWithContext(ctx context.Context, config *Config, next http.Handler, name
 	logger.Debugf("TraefikOidc.New: logoutURLPath configured as: %q", t.logoutURLPath)
 
 	t.providerURL = config.ProviderURL
+	t.tokenCache.SetNamespace(t.tokenCacheNamespace())
 
 	// Use singleton resource manager for metadata initialization
 	rm := GetResourceManager()
@@ -944,6 +945,7 @@ func (t *TraefikOidc) performDynamicClientRegistration() {
 	if t.audience == "" {
 		t.audience = resp.ClientID // Default audience to client ID
 	}
+	t.tokenCache.SetNamespace(t.tokenCacheNamespace())
 	// R162: DCR can provision a client whose method is private_key_jwt
 	// (RFC 7591 ClientMetadata.TokenEndpointAuthMethod) even when the
 	// static config did not set ClientAuthMethod=private_key_jwt. In that
@@ -1083,3 +1085,8 @@ func buildFullURL(scheme, host, path string) string {
 
 	return fmt.Sprintf("%s://%s%s", scheme, host, path)
 }
+
+// tokenCacheNamespace identifies the verification context of this instance.
+func (t *TraefikOidc) tokenCacheNamespace() string {
+	return t.providerURL + "|" + t.clientID + "|" + t.audience
+}