Based on the OAuth 2.0 Token Introspection spec the "aud" field should
be based on the token. Previously "aud" was populated with the id of the
client making the introspection request which seems wrong. This changes
the endpoint to return the value from the token.
The "client_id" field is then changed to return the client id for the
client that originally requested the token rather than returning the
"aud" value from the token.
From the spec https://tools.ietf.org/html/rfc7662:
client_id
OPTIONAL. Client identifier for the OAuth 2.0 client that
requested this token.
aud
OPTIONAL. Service-specific string identifier or list of string
identifiers representing the intended audience for this token, as
defined in JWT [RFC7519].
