Don't make client_id validation required

[aaronpk]

Access token validation is done by a resource server, and it likely will not know the client_id of the client making the request ahead of time, such as when an API is used by an arbitrary number of OAuth clients in an organization. As such, it shouldn't be required to configure the library with a client_id before validating a token.

The Okta .NET and Java SDKs also don't require setting a client_id in order to use the JWT verifier library, so this should match those libraries as well.