fix: support multiple audiences in ID token validation

[dileepapeiris]

Purpose

Fixes ID token validation failure when tokens contain multiple audiences.

Problem:

• Some tokens have multiple audiences in the aud claim (e.g., ["client-id", "additional-audience"])
• SDK was passing audience: clientId (string) to jose.jwtVerify()
• Validation failed because jose couldn't match a string against an array
• Users were logged out during token validation, before the token's natural expiration time

Solution:
Changed the audience parameter from string to array in all crypto-utils files:

• Before: audience: clientId
• After: audience: [clientId]

This allows jose to properly validate tokens with single or multiple audiences.

Related Issues

• Fixes ID token validation fails with tokens containing multiple audiences #383

Related PRs

• N/A

Checklist

• Followed the CONTRIBUTING guidelines.
• Manual test round performed and verified.
• Unit tests provided. (Existing tests cover this - no new tests needed)

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines?
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets?