chore(injector): remove unused JWTAudience field

[huang195]

Companion to kagenti-extensions#432 and kagenti#1653.

What

Remove the JWTAudience field from the webhook injector's NamespaceConfig and ResolvedConfig structs, and the line that read JWT_AUDIENCE from the authbridge-config ConfigMap. Pure dead-code removal:

• cfg.JWTAudience = cm.Data["JWT_AUDIENCE"] was the only writer
• A grep for \.JWTAudience returns zero readers — the value was parsed and never used

Why

The JWT_AUDIENCE env var was a vestige from when the legacy in-pod client-registration sidecar may have consumed it; that sidecar has long since been replaced by the operator's ClientRegistrationReconciler (which doesn't read it). The companion kagenti PR drops the env var from the chart's authbridge-config ConfigMap. After both PRs land, the env var is gone end-to-end.

The JWT-SVID client-assertion audience used by authbridge's tokenexchange plugin is now sourced per-tokenexchange-instance from the in-process SPIFFE provider config (kagenti-extensions#432's redesign), not via a cluster-wide env var.

Sequencing

This PR is fully orthogonal to the other two. It can land in any order:

• Before kagenti#1653 (chart still sets JWT_AUDIENCE): operator stops reading a key that's still set. Harmless — empty struct field, nothing reads it.
• After kagenti#1653 (chart no longer sets it): operator stops trying to read a key that's no longer set. cfg.JWTAudience becomes empty string regardless. Same outcome.
• Independent of kagenti-extensions#432: this PR doesn't touch any volume mount, env var injection, or pod-spec modification. The new authbridge image reads SVIDs via the SPIRE agent socket (already mounted by volume_builder.go:38 at /spiffe-workload-api/spire-agent.sock) — no operator change needed for that.

What this PR does NOT touch (intentional)

• spiffe-helper-config ConfigMap volume mount remains. Old authbridge images still consume it (helper.conf). New images ignore it. Cleanup eligible after all old-image deployments are gone.
• SpiffeHelperConfigMapName constant + SpiffeHelperConf field remain — same backward-compat reason.
• E2E fixtures (jwt_audience="kagenti" inside helper.conf TOML strings) remain.

Test plan

• go build ./... clean (verified)
• go test ./... — all 12 unit-test packages pass (E2E fails environmentally, looking for a Kind cluster named kind; same on main)
• grep confirms zero remaining JWTAudience references in the codebase post-merge

Assisted-By: Claude Code

[pdettori]

Clean dead-code removal — verified via GitHub code search that JWTAudience has zero readers in the codebase (only the 4 lines being deleted). Companion PR sequencing is well-documented and orthogonal.

Areas reviewed: Go structs, config reading logic
CI: All 16 checks passing (E2E, unit, integration, lint, security)
Commit: Signed-off, good message explaining the rationale