Added support for AuthZeroClientConfig.audience

[amcclain]

Hoist P/R Checklist

Pull request authors: Review and check off the below. Items that do not apply can also be
checked off to indicate they have been considered. If unclear if a step is relevant, please leave
unchecked and note in comments.

• Caught up with develop branch as of last change.
• Added CHANGELOG entry, or determined not required.
• Reviewed for breaking changes, added breaking-change label + CHANGELOG if so.
• Updated doc comments / prop-types, or determined not required.
• Reviewed and tested on Mobile, or determined not required.
• Created Toolbox branch / PR, or determined not required.

If your change is still a WIP, please use the "Create draft pull request" option in the split
button below to indicate it is not ready yet for a final review.

Pull request reviewers: when merging this P/R, please consider using a squash commit to
collapse multiple intermediate commits into a single commit representing the overall feature
change. This helps keep the commit log clean and easy to scan across releases. PRs containing a
single commit should be rebased when possible.

[amcclain]

To trigger pre-existing issue (without this change) on Toolbox -

• Disable third party cookies in your browser (Safari > Preferences > Privacy > tick "Prevent cross-site tracking"
• Attempt to load Toolbox on localhost without this change - you should see a "login_required" error due to blocked use of iframe / cookies. Note this would effect any app attempting to use an access token while on localhost or while using an auth0 domain that does not match the app's deployed domain

With this change in hoist-react, update Toolbox's client-creation code to spec audience: 'toolbox.xh.io' like so:

Login should now proceed OK, with both ID and access tokens available. Note also only a single call to the Auth0 token endpoint now needs to be made by the client.

[amcclain]

Note that this change does not attempt to support a possible configuration where multiple access tokens are configured for different audiences. I believe to support that we would need more cases around need for interactive flows from user. Did not think that was a priority - not something we've seen yet.