Unify jwt_audience config key for signer and validator (#67494)

* Unify jwt_audience config key for signer and validator

The JWT signer in BaseAuthManager._get_token_signer() read `jwt_audience`
from the `[api]` section while the validator in _get_token_validator()
read from `[api_auth]` — the documented option (only `[api_auth]
jwt_audience` is declared in config.yml; `[api] jwt_audience` is not
documented anywhere).

Both defaults are `apache-airflow` so out-of-box behaviour is correct,
but a deployment that sets a custom audience under the documented
`[api_auth]` section would have its tokens signed with the default
"apache-airflow" while the validator looks for the configured audience,
silently rejecting every token.

Switch the signer to read from `[api_auth] jwt_audience` (the documented
section). The undocumented `[api] jwt_audience` setting was never part of
the schema, so removing it does not constitute a backwards-incompatible
change for any documented configuration.

* Honour legacy [api] jwt_audience with deprecation warning

Keep accepting jwt_audience from the undocumented [api] section that
the buggy signer used to read, so deployments that worked around the
original bug by setting it there continue to function. Emit a
DeprecationWarning steering operators to the documented [api_auth]
location, and add a newsfragment explaining the bug and the migration
path for each configuration shape ([api_auth] only, [api] only, both,
neither).