Resolves the trusted RFC 8707 audience set for an Attesto access token.

Static resource identifiers are grant-agnostic and require no client lookup. When a token carries an audience outside that static set, the signed client_id selects the original OAuth client and its resource_indicators[:allowed_resources_for] policy. The client that calls introspection or token exchange never supplies this issuance policy.

resolver/1 is intended for Attesto.Token.verify/3's :trusted_audiences option. The core invokes it only after every other token check succeeds and converts resolver failures into :invalid_audience.

A dynamic audience on a CIMD client may consult the bounded, SSRF-guarded client-metadata resolver. Successful documents are cached; a fetch failure is deliberately not cached under the CIMD/RFC 9111 rules and makes that token inactive. Static audiences bypass client resolution and all network work.