Fix allow multiple audiences

[shnmorimoto]

Original issue is square/go-jose#286
And PR for v2 is square/go-jose#369

This PR allows multiple audiences.

Test result is below

$ go test ./jwt
ok      github.com/go-jose/go-jose/v3/jwt

[shnmorimoto]

@csstaub Sorry for bothering you.
Could you review this PR when you have a moment?

[csstaub]

LGTM. Thank you for the pull request!

[shnmorimoto]

@csstaub Thank you so much!

[sergiught]

Hey @shnmorimoto appreciate the fix provided over here.

@csstaub I'm wondering if we could merge go-jose/go-jose@v2 branch with the latest from square/go-jose and then incorporate this fix in there as well so we could make use of it already?

Or alternatively is the v3 still under development and not stable yet? Or is the README simply outdated?:)

Appreciate your time in answering these! 🙇🏻

[jsha]

Confirming that the new behavior is correct per RFC 7519 Section 4.1.3:

4.1.3. "aud" (Audience) Claim

The "aud" (audience) claim identifies the recipients that the JWT is
intended for. Each principal intended to process the JWT MUST
identify itself with a value in the audience claim. If the principal
processing the claim does not identify itself with a value in the
"aud" claim when this claim is present, then the JWT MUST be
rejected. In the general case, the "aud" value is an array of case-
sensitive strings, each containing a StringOrURI value. In the
special case when the JWT has one audience, the "aud" value MAY be a
single case-sensitive string containing a StringOrURI value. The
interpretation of audience values is generally application specific.
Use of this claim is OPTIONAL.

(emphasis mine)