traefik plugin 0.7.7 (#73)

* Automatic discovery of the scopes.

Issue #61 raised very valid concerns about users configuring scopes that are not supported by the provider.
This change introduces automatic discovery of supported scopes by fetching the provider's discovery document and filtering out unsupported scopes.

Before:
User configures: scopes: ["openid", "profile", "email", "offline_access"]
Self-hosted GitLab: "The requested scope is invalid, unknown, or malformed"
Authentication: ❌ FAILS

After:
User configures: scopes: ["openid", "profile", "email", "offline_access"]
Middleware checks discovery doc → offline_access not supported
Automatically filters to: ["openid", "profile", "email"]
Authentication: ✅ SUCCEEDS

* Resolves issue #74 by enabling user to specify expected audience in the configuration.

* Fix flaky tests.

main.go

@@ -157,6 +157,12 @@ func NewWithContext(ctx context.Context, config *Config, next http.Handler, name
 		metadataCache:  cacheManager.GetSharedMetadataCache(),
 		clientID:       config.ClientID,
 		clientSecret:   config.ClientSecret,
+		audience: func() string {
+			if config.Audience != "" {
+				return config.Audience
+			}
+			return config.ClientID
+		}(),
 		forceHTTPS:     config.ForceHTTPS,
 		enablePKCE:     config.EnablePKCE,
 		overrideScopes: config.OverrideScopes,
@@ -192,6 +198,14 @@ func NewWithContext(ctx context.Context, config *Config, next http.Handler, name
 		cancelFunc:              cancelFunc,
 		suppressDiagnosticLogs:  isTestMode(),
 		securityHeadersApplier:  config.GetSecurityHeadersApplier(),
+		scopeFilter:             NewScopeFilter(logger), // NEW - for discovery-based scope filtering
+	}
+
+	// Log audience configuration
+	if config.Audience != "" && config.Audience != config.ClientID {
+		t.logger.Infof("Custom audience configured: %s", config.Audience)
+	} else {
+		t.logger.Debugf("No custom audience specified, using clientID as audience: %s", t.clientID)
 	}
 
 	t.sessionManager, _ = NewSessionManager(config.SessionEncryptionKey, config.ForceHTTPS, config.CookieDomain, t.logger)
@@ -345,7 +359,11 @@ func (t *TraefikOidc) initializeMetadata(providerURL string) {
 // Parameters:
 //   - metadata: A pointer to the ProviderMetadata struct containing the discovered endpoints.
 func (t *TraefikOidc) updateMetadataEndpoints(metadata *ProviderMetadata) {
+	t.metadataMu.Lock()
+	defer t.metadataMu.Unlock()
+
 	t.jwksURL = metadata.JWKSURL
+	t.scopesSupported = metadata.ScopesSupported // NEW - store supported scopes from discovery
 	t.authURL = metadata.AuthURL
 	t.tokenURL = metadata.TokenURL
 	t.issuerURL = metadata.Issuer