Backport CIMD assertion audience fix to v3

[jlowin]

This backports #4659 to release/3.x. OAuthProxy advertises a token endpoint like https://example.com/token, but the stable branch currently validates CIMD private_key_jwt assertions against https://example.com//token because Pydantic adds a trailing slash to a bare-origin base_url. Spec-following clients therefore fail authentication with invalid_client.

The expected audience now comes from the same normalized token endpoint URL advertised in metadata, while preserving path-mounted deployments:

proxy = OAuthProxy(base_url="https://example.com", ...)
proxy.token_endpoint_url  # "https://example.com/token"

Fixes #4789