Normalized authentication result attached to the runtime context.
audiences and scopes are claims the authenticator has actually
validated. Protected HTTP resources reject successful-looking results that
do not prove the configured resource and required scopes.
The older verified_audiences and verified_scopes names remain accepted
as compatibility aliases. New authenticators should use the canonical
fields; contradictory canonical and compatibility values are rejected.