Zitadel should only send one client id in the audience

As a developer I want to be able to connect any application to Zitadel, even if they required only one client in the audience.

Due to Zitadels unique design of projects and applications, always a list of client ids and a project id are included in the audience claim of the token.

Some applications do have problems with that approach as they expect only one client id. (Example: Proxmox)

Generally we do not want to change that behaviour in Zitadel, as this helps a lot of applications and would also be breaking.

Acceptance Criteria

• I am able to get a token, which only includes the client id of the requesting client in the token

Questions

There are different approaches how we could achieve this, some thoughts I have:

• Config on project or app?
• Scope?
• Actions?