String audience is not parsed correctly on userinfo

When using dex as an IdP with userinfo authentication, the `aud` returned from the userinfo endpoint is a string with the value of the `client_id`. Our code expects `aud` to be an array of strings (`[]string`) that includes the client_id.

While this works fine with hydra, there are a couple of issues with this:
- only signed userinfo responses (https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse) are required to include the `aud` claim. We don't use signed userinfo, so our assumption that the `aud` will be there will not always be true
- the `aud` claim can be either a list of strings or a single string (https://openid.net/specs/openid-connect-core-1_0.html#IDToken), our code should handle both cases

Start by locating the userinfo authentication path and its aud parsing; compare handling of a string, an array, and an absent claim against the OpenID Connect references linked in the issue. Done means valid Dex-style string audiences are accepted, array audiences continue to work, and unsigned responses without aud do not fail solely because the claim is missing.

Written by the indexing model from the issue text.