fix(python): omit the audience claim when none is given

[mkzung]

Description

generate_jwt in the Python SDK emits "aud": null when no audience is given. The other four SDKs leave the claim out.

That split dates to #484, which stopped all of them defaulting to ["cdp_service"]. Its TypeScript test says what was wanted:

-    expect(payload.aud).toEqual(["cdp_service"]);
+    expect(payload.aud).toBeUndefined(); // aud claim should not be present

Go took if len(options.Audience) > 0; TypeScript's undefined is dropped by JSON.stringify; Java uses ifPresent; Rust reached the same place in #667 with skip_serializing_if. Python's dict literal keeps the key, and None serialises to null. RFC 7519 4.1.3 makes aud a StringOrURI or an array of them, so null is neither.

The two tests that pinned it are updated from assert decoded["aud"] is None to assert "aud" not in decoded.

One more gap, not in this PR: iat is in the Go, Rust, Java and TypeScript developer JWTs and has never been in Python's, though generate_wallet_jwt does send it. That is #808, kept separate so you can take one without the other.

Tests

make test 1244 passed, make lint and make format-check clean. Reverting the source turns exactly test_generate_jwt_ec and test_generate_websocket_jwt_ec red.

Every generator path decoded before and after, with the clock and nonce claims compared by presence:

path                       before                     after
EC key, REST               aud: null present          aud absent
EC key, websocket          aud: null present          aud absent
EC key, expires_in 300     aud: null present          aud absent
Ed25519 key, REST          aud: null present          aud absent
Ed25519 key, websocket     aud: null present          aud absent
EC key, audience supplied  aud: ["cdp_service"]       unchanged
generate_wallet_jwt        unchanged                  unchanged

Headers are byte-identical on all seven, and sub, iss, nbf, exp and uris are untouched.

Checklist

• Updated the typescript README if relevant
• Updated the python README if relevant
• Added a changelog entry
• Added e2e tests if introducing new functionality

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1