client_credentials grant type accepts audience at creation, but doesn't return them in access token

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Network project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

No audience is returned for client_credentials grant flow even when the audience parameter is explicitly set. This issue results in an invalid JWT token when validating it because of an empty aud claim.

How to set up an audience for the client? Docs doesn't help - https://www.ory.sh/docs/hydra/guides/audiences, same for tutorial - https://www.ory.sh/docs/hydra/5min-tutorial

Reproducing the bug

This is easily reproducible:

1. Start Ory Hydra with minimal setup - docker run --name hydra -e DSN=memory -e SECRETS_SYSTEM=abcdefghjklimnop -e STRATEGIES_ACCESS_TOKEN=jwt -p 4444:4444 -p 4445:4445 oryd/hydra:v2.0.3 serve all --dev
2. Create client_credentials client with specified audience.
   docker exec hydra hydra create client --endpoint http://127.0.0.1:4445/ --format json --grant-type client_credentials --audience account.
3. Send a request without the audience

curl --location 'http://localhost:4444//oauth2/token' \
--header 'Authorization: Basic M2M0OGI5Y2QtNzEyNS00ZDFkLThkZDMtMGJiYTIzNGQ4NGNiOmo2LjBET2h4U0stVnpHaUhnUHVoLnppNEJQ' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials'

3. We can verify that the audience is validated but not returned in the response by specifying the incorrect value.
   Adding --data-urlencode 'audience=account' results in the same response as without the audience.
4. Response example

{
    "access_token": "***",
    "expires_in": 3599,
    "scope": "",
    "token_type": "bearer"
}

Relevant log output

{"audience":["account"],"client_id":"3c48b9cd-7125-4d1d-8dd3-0bba234d84cb","client_name":"","client_secret":"j6.0DOhxSK-VzGiHgPuh.zi4BP","client_secret_expires_at":0,"client_uri":"","created_at":"2023-02-15T01:55:55Z","grant_types":["client_credentials"],"jwks":{},"logo_uri":"","metadata":{},"owner":"","policy_uri":"","registration_access_token":"ory_at_v9rdUliw9PqR3X7saMk-GdMqUA-MH-HPfwyxg1ARDdQ.R6sB7EKSB0I5BoNftG6pGlqP7k2XWtxB3i5vrbXKOK4","registration_client_uri":"http://localhost:4444/oauth2/register/3c48b9cd-7125-4d1d-8dd3-0bba234d84cb","request_object_signing_alg":"RS256","response_types":["code"],"scope":"offline_access offline openid","subject_type":"public","token_endpoint_auth_method":"client_secret_basic","tos_uri":"","updated_at":"2023-02-15T01:55:55.234026Z","userinfo_signed_response_alg":"none"}

Relevant configuration

No response

Version

2.0.3(latest)

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Docker

Additional Context

I'm unable to use Ory Hydra as a token provider for Kafka Oauthbearer OIDC because of empty audience array, which is unexpected for JwtConsumer.

Keycloak works fine since it returns audience.

Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT (claims->{"aud":[],"client_id":"a61f7d4d-e365-4134-8b5c-2053213b4cd8","exp":1676427193,"ext":{},"iat":1676423593,"iss":"http://localhost:4444/","jti":"a98d16a5-6bfd-4498-b3d9-ef6d961615f9","nbf":1676423593,"scp":[],"sub":"a61f7d4d-e365-4134-8b5c-2053213b4cd8"}) rejected due to invalid claims or other invalid content. Additional details: [[8] Audience (aud) claim [] present in the JWT but no expected audience value(s) were provided to the JWT Consumer. Expected one of [] as an aud value.]
	at org.jose4j.jwt.consumer.JwtConsumer.validate(JwtConsumer.java:459)

Start by reproducing the issue with the documented docker run setup, hydra create client, and /oauth2/token request using the client_credentials grant. Trace how the configured audience is handled when issuing the access token. Done means the resulting JWT contains the configured audience and the behavior is covered by an appropriate test.