PR #3787 fixed audience validation for custom identifier_uri values (like api://my-app-name from Bicep deployments) by switching from audience=client_id to audience=identifier_uri. But this broke the default case: when identifier_uri is the default api://{guid}, Azure AD v2 tokens set aud to the bare GUID, not the api:// form — so every token got rejected.

The fix accepts both formats as valid audiences, which JWTVerifier already supports natively. This is safe because both values are identifiers for the same Azure app registration — client IDs are GUIDs and can't collide with URI-format identifier URIs.

# Before (3.2.0): only bare GUID — broke custom identifier_uri
audience=client_id

# Before (3.2.1): only identifier_uri — broke default api://{guid} case  
audience=self.identifier_uri

# Now: both — works for v1 tokens, v2 tokens, and custom URIs
audience=[client_id, self.identifier_uri]

Fixes #3796