Allow auth for OIDC tokens that do not contain a group claim

I am using Microsoft Entra ID for OIDC authentication to Vault, but I'm unable to authenticate with a user that is not a member of any groups. My Vault JWT role is configured to look for a `groups_claim`, however, Vault presents the following error if the claim is not included with the token:

```text
failed to fetch groups: "groups" claim not found in token
```

Microsoft Entra ID [doesn't send any configured claims if the attribute carries no value in it](https://learn.microsoft.com/en-us/answers/questions/1004014/is-it-possible-to-send-an-empty-group-claim-when-a), so users that are not a member of a group are unable to authenticate to Vault.

Can vault-plugin-auth-jwt be updated to authenticate users when the group attribute is missing from the token? In such cases, I would like users to be assigned the default policy that was configured for the JWT role.

No files or tests are identified in the issue. Start by tracing how the JWT role's groups_claim is handled when the claim is absent, then verify the expected authentication path for a token without groups. Done means such users authenticate and receive the JWT role's default policy.

Written by the indexing model from the issue text.