JWT: add optional KeySetSearcher callback to Validator

[suraj-simha]

Adds an optional KeySetSearcher callback to the JWT Validator to support dynamic KeySet lookup based on the JWT's key ID (kid) header. When provided, the Validator extracts the kid from the JWT header and calls the callback to retrieve the appropriate KeySet, instead of the default sequential KeySet verification.

Motivation:
Vault's JWT auth plugin uses CAP for JWT validation, which delegates signature verification to go-oidc. The current flow checks each keyset's cache and if the key is not found, fetches from the JWKS URL before moving to the next keyset. This sequential fetch-per-keyset behavior was causing a performance issue for a customer with multiple JWKS endpoints configured.

This change adds a KeySetSearcher callback to CAP's Validator, allowing the plugin to implement custom KeySet lookup logic. The Validator handles all JWT parsing and security validation (extracting the kid from the JWT header, verifying the signature with the returned KeySet), while the callback provides the logic for locating the appropriate KeySet. This enables implementations to check all caches before refreshing any keys from remote JWKS URLs.

The NewValidatorWithKeySetSearcher constructor has been added to avoid modifying the existing NewValidator. Existing callers using NewValidator are completely unaffected.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[jimlambrt]

Do we want explicit tests for error cases for things like multi-signatures, missing kids, malformed token?

[suraj-simha]

Do we want explicit tests for error cases for things like multi-signatures, missing kids, malformed token?

Yep, added tests for those cases. Thanks for calling it out!

[jimlambrt]

Ty