JWT login does not support `aud` claim as string, only array

This issue has been migrated from [#14327](https://github.com/matrix-org/synapse/issues/14327).

---

### Description

First off, big thanks to everyone who works on Synapse and Matrix. You're the best!

I have a "main" app which issues JWT tokens to clients, which then use it to log in to Synapse and acquire access/refresh tokens. I am hardening this process with validation of the `iss` and `aud` claims.

My token generation library is flattening the single audience ID to a string claim value, which is allowed by the RFC but Synapse rejects.

My clue that this might be the case was in [the documentation](https://github.com/matrix-org/synapse/blob/7911e2835df7b4bf1dec98b09da89beda65e2ab2/docs/jwt.md#how-to-test-jwt-as-a-developer), which wraps a single audience value in an array.

Here's the relevant section of [the RFC](https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.3):

```
...
In the general case, the "aud" value is an array of case-
sensitive strings, each containing a StringOrURI value. In the
special case when the JWT has one audience, the "aud" value MAY be a
single case-sensitive string containing a StringOrURI value. The
interpretation of audience values is generally application specific.
Use of this claim is OPTIONAL.
```

The "application specific" wording there _I think_ gives Synapse some leeway in saying, look we only accept an array, but I think it's better to accept tokens formatted either way, at the risk of creating some "WTF" moments in token validation.

### Steps to reproduce

- Specify an audience for validation of JWT tokens
- Attempt login with a token that contains a string value for the `aud` claim.
- Synapse rejects the JWT as invalid.

### Homeserver

Self-hosted

### Synapse Version

1.68

### Installation Method

Docker (matrixdotorg/synapse)

### Platform

GKE

### Relevant log output

```shell
n/a
```

### Anything else that would be useful to know?

_No response_

Start with docs/jwt.md, especially the linked developer testing section, and reproduce the reported login failure using a JWT whose single aud claim is a string. Done means Synapse accepts both the RFC-described single-string audience and the array form when audience validation is configured.

Written by the indexing model from the issue text.