Not supporting [RFC 9068] Must add issuer claim to the access token JWT!

[StefanoMantero]

As already mentioned by @Sephster, now the issuer is mandatory!

@Sephster wouldn't RFC 9068 be the relevant spec here? (Now, anyway... I think it did not exist yet when this conversation started.) That does make iss required.

Originally posted by @tgr in #1137 (comment)

[Sephster]

Thanks for this. It looks like we will need to support RFC9068 going forwards but at the moment, I'm not sure if just changing the iss to required will satisfy it. I suspect not and this will likely result in a major release. I'll tag this as a future development.

[hafezdivandari]

"OAuth 2.0 Authorization Server Issuer Identification" RFC9207