JWTClaims.validate() skips iss and aud validation by default

Description

authlib's `JWTClaims.validate()` does not check `iss` (issuer) or `aud` (audience) claims by default. A token with `iss='attacker.com'` and `aud='not-my-service'` passes `validate()` without error. Explicit `validate_iss()` and `validate_aud()` calls or `ResourceProtector` configuration are required.

Reproduction

from authlib.jose import jwt, OctKey
import time
key = OctKey.import_key(b'a' * 32)
token = jwt.encode({'alg': 'HS256'}, {'sub': 'user', 'iss': 'attacker.com', 'aud': 'not-my-service', 'exp': int(time.time())+3600}, key)
claims = jwt.decode(token, key)
claims.validate()  # No error — wrong issuer/audience accepted