Cleanup JWT valid audience and tenant id resolution

[rodrigobr-msft]

The current implementation configures the JWT validator simply checks if the audience matches one of the client ids in the Connections config

[chris-wwt]

Does this task imply an automatic way to restrict a bot response to the specified tenant?

As I understand it at the moment, aud is validated from the JWT, but the tenant is not. This makes bots multi-tenant by default, unless the developer manually checks the tenant ID in the teams channel data as described here.

Ideally, it would be great if we could just have a configuration that controls this behavior. Personally, my preference would be that these bots should be single-tenant by default.

[rodrigobr-msft]

In the linked PR, a VALIDATE_ISSUER field is added to AgentAuthConfiguration to control that behavior. We may revisit the default behavior, which is currently to not validate the issuer.