oauth: always write the audience of rpc scopes #72

to_string_normalized dropped ?aud=*, writing rpc:. The spec says aud is "always required in granular string representation", and the reference server ignores rpc scopes without it, so these scopes were silently never granted.