* Refuse SSH JWT auth when the client changes the user name between auth requests on one connection
* Run SSH sessions and SFTP as the OS user that was authorized, taken from the connection context
* **New Features**
* SSH server JWT validation now accepts multiple audiences with backward-compatible handling of the previous single-audience setting and a guard ensuring at least one audience is configured.
* **Tests**
* Test suites updated and new tests added to cover multiple-audience scenarios and compatibility with existing behavior.
* **Other**
* Startup logging enhanced to report configured audiences for JWT auth.
Viktor Liu