Enable publisher control of accepted audience

[DrDaveD]

cvmfs_scitoken_helper enforces publisher control of issuer and scope, but the audiences it accepts are hardcoded. It should also get the list of acceptable audiences from the publisher.