golang-jwt provides all the necessary functionality to parse and verify
LogoutTokens. This gets us rid of the direct go-jose dependency and
quite a bit of custom crafted jwt verification code.
The "aud" claim of the logout token is supposed to contain the client-id
of the client for which the token was issued. Our current implementation of
validating that claim is somewhat broken. We only allow to configure a single
value for the allowed client id. But we have different client-ids
accessing oCIS.
This completely removes the current validation of the `aud` claim until
we come up with a working solution. As we currently require a session id
to be present in the logout token the risk not validating the `aud`
claim is pretty low.
Related: #6149
Ralf Haferkamp