fix(openid-connect): enforce audience, issuer and required scopes (#13829)