chore(jira): Use new CDN signed installs

[leeandher]

See: API-2184

In this post Jira introduced a breaking change on their Atlassian Connect platform that changes the way we verify installations. Now, we take a key id from the JWT headers, get the associated RSA key from their CDN, and then decode the JWT with that instead. This change has only been rolled out for installs/uninstalls, so that is the only place this code will be run.

Here is a demo installation/testing

installation.demo.mov

Here is the rest of the Jira integration working as expected

Screen.Recording.2021-10-21.at.2.46.06.PM.mov

Here is bitbucket being unaffected

There is some display issue happening with my bitbucket account but that appears to be a separate bug. I was able to reproduce it on Sentry.io and master so that's out of scope. That ticket has also been created API-2199

unaffected.bitbucket.mov

[manuzope]

Can we ensure this doesn't break anything for Bitbucket? I doubt they send the kid but to be sure. We should also make sure that when we get webhooks from JIRA (issue update webhooks), those don't break.

[leeandher]

@manuzope i will double check that no other hooks are affected from bitbucket or jira server as well, but like you said without the kid in the jwt headers it should fall back to previous behavior. I'll attach some more screenshots and vids to the PR once i have those ready.