SDK validation func should accept an expected subject to match the sub claim

[yolocs]

TL;DR

If the subject doesn't match, the token validation should fail. Validating breakglass token should preserve its current logic.

Detailed design

No response

Alternatives considered

No response

Additional information

No response

[yolocs]

cc: @sethvargo