AAI-268 fix token verification: need to allow for different issuers

[marius-mather]

Description

AAI-268: while trying to use the backend API to sync Auth0 roles, discovered that the backend doesn't handle the token issuer well - tokens from Auth0 can either have the tenant domain (tenant.au.auth0.com) or the custom domain (mydomain.org) as their issuer. We probably want to allow for both (may want to get tokens from Auth0 in scripts, or log in via AAI Portal), so add an extra config option to allow this.

Changes

• Add auth0_issuer setting
• Check both the auth0 domain and the optional issuer setting when verifying tokens
• Unit tests of token verification

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)

How to Test Manually (if necessary)

Run uv run pytest