feat(oidc): make audience claim configurable via environment variable

[maany]

Summary

Replaces the hardcoded OIDC audience value with a configurable OIDC_EXPECTED_AUDIENCE_CLAIM environment variable.

Changes

• Added oidcExpectedAudience() method to EnvConfigGateway (defaults to rucio)
• Updated OIDC provider configuration to fetch audience from environment
• Implemented JWT audience validation with non-blocking warnings
• Updated development template to use atlas-rucio-oidc-client
• Added documentation to README and env-generator README

Backward Compatibility

• Defaults to rucio if not configured
• Validation logs warnings but doesn't block authentication
• Production environments get rucio default via env-generator

Reviewer Checklist

Reviewer Checklist (Required)

• Reviewer competence: I am sufficiently familiar with this domain/system to review this PR

  (If not, a subject-matter expert has been involved.)

• Problem fit: I understand the issue being addressed, and this PR solves the actual root problem

• Solution quality: The approach is sound, maintainable, and appropriate for this codebase

• Security: No new security risks are introduced

• Backward compatibility & performance: No unintended breaking changes or unacceptable regressions

• Documentation: Relevant documentation or comments are updated or explicitly not required

---

Approval Notes

When approving, briefly explain what this PR does, why the approach is correct, and anything the merger should pay attention to.

Example guidance (not to be deleted):

• What problem is solved?
• Why is this approach acceptable?
• Any trade-offs, risks, or follow-ups?
• Anything non-obvious for the merger or future maintainers?

Approval summary:
- Problem:
- Solution:
- Risks / trade-offs:
- Notes for merger: