fix(security): classify audience failures by sentinel error

The lenient-audience path chose itself when the verify error text
contained the word audience. The key lookup error embeds the kid from the
unverified token header. A kid of audience made a failed signature look
like an audience-only failure. verifyAudience now returns a sentinel and
the caller uses errors.Is.

audience_sentinel_test.go

@@ -0,0 +1,24 @@
+package traefikoidc
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+)
+
+// Only a real audience mismatch may select the lenient-audience path; an
+// error text that merely embeds the attacker-chosen kid must not.
+func TestAudienceErrorClassifiedBySentinel(t *testing.T) {
+	if !errors.Is(fmt.Errorf("standard claim verification failed: %w", verifyAudience("x", "y")), errInvalidAudience) {
+		t.Fatal("audience mismatch not recognized through wrapping")
+	}
+	if errors.Is(verifyAudience("y", "y"), errInvalidAudience) {
+		t.Fatal("matching audience classified as mismatch")
+	}
+	for _, kid := range []string{"audience", "invalid audience"} {
+		err := fmt.Errorf("failed to get public key: no matching public key found for kid: %s", kid)
+		if errors.Is(err, errInvalidAudience) {
+			t.Errorf("kid %q fooled the audience classifier", kid)
+		}
+	}
+}