security: harden introspection verifier — fix client_id fallback and wire config.audience

## Summary

Two hardening items for `buildIntrospectionVerifier` in `src/mcp_server/auth/oauth.ts`, deferred from PR #63.

### 1. client_id fallback

When the introspection response omits `client_id`, the verifier currently substitutes the resource server's own `clientId`. This means `SCS_MCP_OAUTH_ALLOWED_CLIENT_IDS` is evaluated against the wrong principal. The fix should reject the token (fail closed) when `client_id` is absent from the introspection response.

### 2. config.audience override not wired

`buildIntrospectionVerifier` does not receive `config.audience`, unlike the JWKS path. Audience validation therefore cannot use an explicit override. The fix should accept `config.audience` as a parameter and use it during audience validation, mirroring the JWKS verifier behaviour.

### Out of scope

Missing `aud` in introspection responses is **intentionally not fail-closed**: providers such as Keycloak routinely omit `aud` from introspection results, so skipping audience validation when `aud` is absent is acceptable behaviour.

---

Reported in: #63 (comment: https://github.com/elastic/semantic-code-search-mcp-server/pull/63#discussion_r2966566961)
Requester: @Coolomina