Authorization behavior change for multiple audiences

[jsha]

Looking at square/go-jose#286 and #10 (merged), I see a bit of an issue: the existing behavior in v3.0.0 is that each audience in an Expected must match an audience in a Claim for Validate to pass. The behavior at the head of the v3 branch is that one audience in an Expected must match an audience in a Claim for Validate to pass.

This is correct behavior per the spec, but is a potentially breaking change in an authorization code path, with no accompanying change in types or names to make sure people pay attention. I'm concerned that users may be depending on the old behavior (each matches) and silently break when upgrading.

Here's my proposed fix: restore the old behavior for Expected.Audience, and deprecate that field. Add a new field Expected.SingleAudience string, and give the new behavior to that field.

[jsha]

Bumping this issue to say we reverted the behavior change, but plan to roll it forward in a v4 branch (with an updated field name).