Remove reliance on x5c property at /jwks

[patcon]

The staging /jwks endpoint: https://te-auth.id.tbs-sct.gc.ca/oxauth/restv1/jwks

Success criteria: Finding another way to check token sigs without using 5xc property.

This would allow us to take a step toward replacing our custom auth app (for local development and CI) with one of the more turn-key mock oauth2 server.

I recommend we remove our usage of the poorly supported (as per a few mock oauth server projects) and unadvised (as per Google Engineering and also in-practice in their infra) openid feature (the x5c property).

Benefits

This would allow us to more easily benefit from migrating to a mock oauth2 server (for local development and CI). Migrating to a mock server would allow us to abandon our own auth app, and the special-case auth code paths within api app.

Relevant code

Where we process the x5c property into a config object we use to later check token sigs:

gc-digital-talent/api/app/Services/OpenIdBearerTokenService.php

Lines 74 to 80 in 13ae7e3

	$certificateChain = array_values(data_get($value, 'x5c'))[0];
	$config = Configuration::forAsymmetricSigner(
	$signer,
	InMemory::empty(), // Private key is only used for generating tokens, which is not being done here, therefore empty is used.
	InMemory::plainText('-----BEGIN CERTIFICATE-----' . "\n" . $certificateChain . "\n" . '-----END CERTIFICATE-----'),
	);

Email from Doug Harris of SiC:

The “x5c” property contains the same public key represented by the “n” and “e” properties, just presented as an X.509 certificate for any software out there that might prefer the older format. It is completely redundant and ignored by most software I’ve worked with.

As long as your software is still checking the signature on our ID tokens the normal way you can ignore the “x5c”.

Added this to icebox for now. cc @tristan-orourke

[patcon]

This is noted missing support from the library we're using: lcobucci/jwt#32 (comment)

This is a library suggested for it: https://github.com/acodercat/php-jwk-to-pem

Or this is perhaps better, as a more minimal dep is required, which doesn't pull in phpseclib:
lcobucci/jwt#32 (comment)

[yonikid15]

This is resolved in #2813