Support for JSON Web Key Sets

[swiffer]

Solution for #504

• The way secretKey is currently used to built a Key and decode the token does not allow JWKS
• A different configuration key jsonWebKeySet has been introduced to not dilute the meaning of the secretKey

Let me know what you think

[swiffer]

For now removed guidance of caching / storing the public key as this can lead to unexpected behaviour when keys are rotated.

Auth0 has some guidance regards caching:

https://community.auth0.com/t/caching-jwks-signing-key/17654/2

Unclear currently if this is something that should be supported in php-jwt, here or within the app. Guess it would be best to have it in firebase/php-jwt and beeing able to configure it.

Opened a Issue there:

firebase/php-jwt#384

[swiffer]

@ADmad / @markstory - thanks for you reviews - added a test and made several improvements (see comments)

[othercorey]

@swiffer looks like the target branch was change to 2.next. Can you rebase the PR?

[ADmad]

looks like the target branch was change to 2.next

Thus is a non trivial feature addition, so better to target the next minor release, hence I changed it to 2.next.

[swiffer]

Can we get it merged or is something missing? :)

[markstory]

Is this file used? I don't see it referenced in this diff.

[swiffer]

It's not used directly at the moment. But as the fake JSON response is containing a key set with two public keys I thought it's helpful to also include both private keys... Should I remove it?

[markstory]

No that's ok.

[othercorey]

@swiffer Nice work!

[swiffer]

Thanks! Hopefully useful for others as well. Looking forward to the next release :)