Resolve token_audience from default_oidc_audience in host metadata

[tanmay-db]

🥞 Stacked PR

Use this link to review incremental changes.

• hosttype-metadata [Files changed]
  • default-oidc-audience [Files changed]
    • hosttype-resolved [Files changed]

---

Changes

Resolve token_audience from the default_oidc_audience field in host metadata:

• Add default_oidc_audience field to the HostMetadata dataclass, parsed from the discovery endpoint.
• In Config._resolve_host_metadata(), set token_audience from default_oidc_audience when no explicit token_audience is configured. This takes priority over
  the existing account_id fallback for account-level hosts.
• Remove the TODO comment about adding explicit audience to the metadata endpoint (now implemented).

Tests

• default_oidc_audience sets token_audience when not explicitly configured.
• default_oidc_audience takes priority over the account_id fallback for account hosts.
• Explicitly configured token_audience is not overwritten by default_oidc_audience.
• Falls back to account_id when default_oidc_audience is absent and no workspace_id.

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-py

Inputs:

• PR number: 1371
• Commit SHA: 9fd8f3723bdfd9b86fc3d8c0957c236e06965bc7

Checks will be approved automatically on success.