Upgrade go-jose from v2 to v4

[jamestelfer]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of this SDK and the issue still persists.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

This was previously addressed in #239, but I think this issue might need to be reopened.

On main, the "Versions" section says:

The old square/go-jose repo contains the prior v1 and v2 versions, which are still useable but not actively developed anymore.

Now, a version 2.6.3 was released in March owing to a security vulnerability, so it's possible that some security issues will be backported.

However, the security policy states clearly that only v3 and v4 are supported versions.

It would be good to investigate an upgrade, given the stability and security improvements since v2.

Reproduction

go.mod references go-jose v2.x

Go JWT Middleware version

2.2.1

Go version

1.22