lexicon, oauth: follow the spec for permission-set rpc audiences #71

A permission set with "aud": "*" failed to parse ("regex failure"), because the field was typed as a DID service reference. Expansion was also too permissive: no audience, or inheritAud with nothing to inherit, widened to every service. The spec (https://atproto.com/specs/permission#rpc) allows *, forbids DID references inside a set, and says those cases are invalid and ignored.