populate subject claims and access claims in openapi security

[stevehu]

It should work the same like swagger security

[stevehu]

The reason we put both JWT claims into the auditInfo is to support fine-grained authorization in the business handlers. In that case, there would be some custom claims in the JWT tokens and the fine-grained authorization layer will take the claims to do further security authorisation.