… decisions

JWT cache implementation introduced two new modules: Auth.Jwt and Auth.JwtCache.
This refactoring reorganizes code in Auth and the above two modules so that reponsibilities and dependencies are more clear:

* parseClaims function was moved from Auth.Jwt back to Auth.
Thanks to it Auth.Jwt module became independent from AuthResult data structure and role handling. Its only purpose right now is to parse/verify tokens and validate claims
* validateClaims function in Auth.Jwt module was split to separate validateAud and validateTimeClaims functions. This change was necessary to allow Auth.JwtCache module to be the only place to decide what validations are cached.
* Introduced type level tagging of claim validation results so that it is possible to statically ensure all required validations were performed (see Auth.JwtCache.parseAndValidateClaims signature)
* Made Auth.Jwt module independent from Config module: validateAud no longer takes Config as an argument but a (Text -> Bool) function to validate audience values
*  Auth.JwtCache module was changed so that it is now possilble to cache claims validation results. Tagged claim validation result types are used to ensure all validations are performed regardless of the decision about what should be cached.
* JwtCache datatype in Auth.JwtCache module was renamed to CacheState with JwksNotConfigured, NotCaching and Caching constructors.
* Creation of a Sieve cache instance was moved to a CacheVariant typeclass function newCache
* NeedsReconfiguration typeclass was introduced to handle differences between different CacheVariants in deciding when cache reset is needed (if aud claim validation results are cached we need to reset cache when jwt-aud changes)

Fixes PostgREST#4134 (JWT with aud claim should be rejected if jwt-aud is not set)

Updated default jwt-aud value in Config module.
Updated spec tests.