Make it possible to set `sub` claim for the access token

[vojtad]

By setting sub you can set the subject of JWT access token and make use of domain-wide access configured for the specified service account.