WIP: switch jwt lib

[Nerzal]

This change introduces a breaking change.
Instead of passing the expected audience into the DecodeToken functions, we can validate the expected audience with a call to VerifyAudience: https://pkg.go.dev/github.com/golang-jwt/jwt#MapClaims.VerifyAudience

Adresses issue #292

When using custom claims, you'd have to implement the audience check for yourself for now.
I'm open for better ideas regarding the audience validation.

[msvechla]

In light of the recent CVEs in github.com/dgrijalva/jwt-go I think this breaking change is fine. As long as they are well documented in the Changelog, I don't see an issue with this.