(PXP-6339): Fetch and cache public keys for JWT validation

[vpsx]

Jira Ticket: PXP-6339

New Features

• Facilitate validation of JWTs from non-Gen3 issuers by adding ability to fetch and cache a JWK set from a non-Gen3 server. Authutils will first look for a jwks_uri at .well-known/openid-configuration and fall back to the legacy Gen3 /jwt/keys endpoint. Keys are serialized to PEM and stored (as before) in flask.current_app.jwt_public_keys.

Breaking Changes

Bug Fixes

Improvements

• Account for JWTs in which the scope claim is a space-delimited string (use split instead of just putting scope value in list). We expect RAS visas/all GA4GH embedded tokens to have scope claims with this format.

Dependency updates

Deployment changes

[github-actions]

The style in this PR agrees with black. ✔️

This formatting comment was generated automatically by a script in uc-cdis/wool.