feat:(oidc) derive audience claim from client_id in IdentityToken

[SequeI]

Summary

Resolves #1401

This change updates the OIDC identity token handling to derive the audience (aud) claim from the provided client_id, rather than hardcoding it to "sigstore". (The default value for client_id is 'sigstore' though)

hatch run python -m sigstore --trust-config trust_config.json sign \
--oidc-client-id=<ClientID> --oidc-issuer <customIssuer> \
--oauth-force-oob --overwrite --verbose test.txt

hatch run python -m sigstore --trust-config trust_config.json verify identity \
--cert-identity=<Identity> --cert-oidc-issuer <customIssuer> --verbose test.txt

Signed and verified using a custom Sigstore instance alongside a custom OIDC client and all worked.

Release Note

• derive audience claim from client_id in IdentityToken

Documentation

None