Service account tokens issued by the Kubernetes API server in recent versions are valid OIDC tokens but the do not contain an email in the payload. Update the Payload Type test to interpret tokens with all five required claims as OIDC tokens.