JWT should not be mentioned in programmatic access

[wasaga]

Page: https://www.pomerium.com/docs/capabilities/programmatic-access#callback-handler

What's incorrect or missing

authenticate.example.com is the pomerium-authenticate service, we'll open that in the browser to authenticate, it will be set as iss on the jwt

Programmatic access article mentions JWT claims which is confusing, as end users are not supposed to try and inspect the contents of the token received via programmatic access callbacks.

What's the resolution?

1. tell users the token received via programmatic access callback is an opaque value (even though its called pomerium_jwt) and they should not try to inspect and/or rely on its values.
2. reference the User Identity page from that page as a recommended method to inspect user identity.

Based on this conversation: https://pomerium-com.slack.com/archives/C01GU5Z1YA1/p1686066555152789