Add a new --trusted-issuer-prefix flag that allows configuring issuer URL
prefixes paired with audiences. Any JWT whose issuer starts with a
configured prefix will be dynamically verified via OIDC discovery.
This is useful for multi-tenant setups (e.g. Keycloak realms) where each
tenant has a unique issuer URL under a common prefix, eliminating the need
to enumerate every issuer individually.
Signed-off-by: Peter Triebe <peter.triebe@de.bosch.com>
a301bcc174