JWT verification extension

[TristonianJones]

Support for JWT verification with automation key-fetching.

Introduce jwt.Token type which models the structure of a JWT with a
series of well-defined claims accessible by their human-readable names
as well as support for optional claim-fetching.

As a best practice, you'll want to follow this flow:

• Verify the token is signed and has not expired: jwt.verify (async) or jwt.verifyWithKey (sync)
• Check that the token was presented by a trusted user: jwt.verify(token).presentedBy(aud, iss)
• Inspect additional claims:

  cel.bind(auth, jwt.verify(token), 
      auth.presentedBy(aud, iss) && 
      auth.claim("spiffe-subject").orValue("") == "expected-subject")