fix(apps/kubernetes): switch audience mapper to included.client.audience

Self-review fix: the KeycloakClientScope rendered for the per-cluster
audience used `included.custom.audience` (raw string), but the
project convention — set in
`packages/system/keycloak-configure/templates/configure-kk.yaml` for
the legacy global `kubernetes-client` scope — is
`included.client.audience` (refers to a clientId in the same realm).

Both keys make Keycloak emit the audience claim with the same value
in our setup, but the `client.audience` form is the idiomatic one
when the audience IS a registered client in the realm.

Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>

packages/apps/kubernetes/templates/oidc-keycloak.yaml

@@ -45,7 +45,7 @@ spec:
       protocol: openid-connect
       protocolMapper: "oidc-audience-mapper"
       config:
-        "included.custom.audience": {{ $clientId | quote }}
+        "included.client.audience": {{ $clientId | quote }}
         "id.token.claim": "true"
         "access.token.claim": "true"
         "introspection.token.claim": "true"