HUMAN VERIFICATION REQUIRED ASVS 9.2.3 Audience validation (when self_contained_tokens is used)

The service only accepts tokens which are intended for use with that service (audience). For JWTs, this can be achieved by validating the 'aud' claim against an allowlist defined in the service.