Add --extra-jwt-issuer-jwks-url to override the JWKS URL for an extra
JWT issuer instead of relying on OIDC discovery or the hardcoded
<issuer>/.well-known/jwks.json derivation.
This unblocks issuers such as AD FS, whose iss claim
(http://host/adfs/services/trust) is not an OIDC discovery base and
whose JWKS is served at a different path/scheme
(https://host/adfs/discovery/keys). The issuer match against the
token's iss claim is preserved.
Signed-off-by: Sebastian Schmidt <sebastian.schmidt@dewango.de>
d65167194b