api_jwt: add a `strict_aud` option

[woodruffw]

Key bits:

• There's a new strict_aud option, which defaults to False
• If strict_aud is True, then the following audience checking behavior applies:
  • audience MUST be a str;
  • The aud claim MUST be a str;
  • The audience and aud claim must match exactly.

Closes https://github.com/jpadilla/pyjwt/issues/894.

[jpadilla]

@woodruffw awesome, thanks! mind dropping a note on the changelog? 🙇

[woodruffw]

mind dropping a note on the changelog? 🙇

Sure thing! Doing now.

[woodruffw]

Done in 59511cd.

[jrobbins-LiveData]

If this is also now a valid option on jwt.api_jwt.decode_complete(), then the doc needs to be updated for that function as well.

[woodruffw]

Thanks, looks like I missed that. I'll make a PR in a moment.

[woodruffw]

Opened https://github.com/jpadilla/pyjwt/pull/923 for the doc fix.