Improve configurability of JWT audiences

[keeganwitt]

When the helper is used a sidecar, workloads may know the audiences they need, but not other required parts of the config file. In such cases, requiring them to provide the full configuration file doesn't make sense, and instead some alternative might be more useful, such as

1. A separate config file for JWT audiences
2. JWT audiences set by environment variable(s)

and these could potentially be set by pod annotations and the K8s downward API.