Support multiple "aud" claims in an OAuth JWT

[michaelrsweet]

Currently the cupsOAuthGetTokens API validates the audience ("aud" or CUPS_JWT_AUD) as a single string, however RFC 7519 allows multiple string or URI values as an array.

Update the code to look for a matching client_id in an array of audiences.