for #16139 this fixes a copy/paste error that caused the MDM SSO flow to validate audiences using the global config EntityID since we also consider an audience valid if you set EntityID to be: - the same in both (case for local dev) - your Fleet URL or the full path to the SSO API endpoint (QA) we didn't notice this until now.