traefik plugin 0.7.7 (#73)

* Automatic discovery of the scopes.

Issue #61 raised very valid concerns about users configuring scopes that are not supported by the provider.
This change introduces automatic discovery of supported scopes by fetching the provider's discovery document and filtering out unsupported scopes.

Before:
User configures: scopes: ["openid", "profile", "email", "offline_access"]
Self-hosted GitLab: "The requested scope is invalid, unknown, or malformed"
Authentication: ❌ FAILS

After:
User configures: scopes: ["openid", "profile", "email", "offline_access"]
Middleware checks discovery doc → offline_access not supported
Automatically filters to: ["openid", "profile", "email"]
Authentication: ✅ SUCCEEDS

* Resolves issue #74 by enabling user to specify expected audience in the configuration.

* Fix flaky tests.

jwt.go

@@ -257,12 +257,12 @@ func parseJWT(tokenString string) (*JWT, error) {
 // not-before time (if present), and prevents replay attacks using JTI claims.
 // Parameters:
 //   - issuerURL: Expected issuer URL to validate against
-//   - clientID: Expected audience (client ID) to validate against
+//   - expectedAudience: Expected audience to validate against (can be clientID or custom audience)
 //   - skipReplayCheck: Optional parameter to skip replay attack protection
 //
 // Returns:
 //   - An error describing the first validation failure encountered
-func (j *JWT) Verify(issuerURL, clientID string, skipReplayCheck ...bool) error {
+func (j *JWT) Verify(issuerURL, expectedAudience string, skipReplayCheck ...bool) error {
 	alg, ok := j.Header["alg"].(string)
 	if !ok {
 		return fmt.Errorf("missing 'alg' header")
@@ -290,7 +290,7 @@ func (j *JWT) Verify(issuerURL, clientID string, skipReplayCheck ...bool) error
 	if !ok {
 		return fmt.Errorf("missing 'aud' claim")
 	}
-	if err := verifyAudience(aud, clientID); err != nil {
+	if err := verifyAudience(aud, expectedAudience); err != nil {
 		return err
 	}