Feature Request: Allow inclusion of "jku" header in JWT

[sopgreg]

With a jku header present (JSON Web Key Set URL), a backend can always fetch the latest public keys for a kid for signature verification for the OpenID server. Otherwise, the public keys (which may rotate), need to be configured/hard coded into the backend and rotated appropriately.

A present jku header allows for manipulating and fake signing a JWT. It therefore must be used with caution in the backend and always be checked against a set of allowed URLs.

The Jose lib allows to includes this header via

com.nimbusds.jose.JWSHeader.Builder#jwkURL(URI jku)

There is no possibility though to configure this for

no.nav.security.mock.oauth2.token.OAuth2TokenProvider#jwsHeader

which is hardcoded like this and only includes the kid, typ and alg headers:

    private fun jwsHeader(
            keyId: String,
            type: String,
            algorithm: JWSAlgorithm,
        ): JWSHeader =
            JWSHeader
                .Builder(algorithm)
                .keyID(keyId)
                .type(JOSEObjectType(type))
                .build()