Upgrade golang-jwt to v5

[ilaleksin]

Description

This PR addresses #1396
It upgrades golang-jwt to v5 and MicahParks/keyfunc to v2.0.3

• refactored JWT claims to align with jwt v5 interface.
• added a separate WithIssuedAt validation because the iat claim check was removed from jwt.Parse() function
• added one unit test to verify a case when iss alias is set but the JWT iss claim has the original issuer value
• keyfunc is upgraded to v2 because it depends on golang-jwt v5 while keyfunc v1 depends on golang-jwt v4

References

https://github.com/golang-jwt/jwt/blob/main/MIGRATION_GUIDE.md#parsing-and-validation-options
https://github.com/MicahParks/keyfunc/releases/tag/v2.0.0

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 86.37%. Comparing base (fa4ff8d) to head (4a3e97f).
Report is 6 commits behind head on main.

❗ Current head 4a3e97f differs from pull request most recent head 7b5bea9. Consider uploading reports for the commit 7b5bea9 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1601      +/-   ##
==========================================
+ Coverage   86.27%   86.37%   +0.10%     
==========================================
  Files          87       86       -1     
  Lines        8239     8226      -13     
==========================================
- Hits         7107     7104       -3     
+ Misses        798      791       -7     
+ Partials      334      331       -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[adriantam]

nitpick: this line can be combined with the next line.

[miparnisari]

Please upgrade to v3: https://github.com/MicahParks/keyfunc/tree/v3.3.2

[miparnisari]

You can get rid of this block and change line 74 to

jwtParser := jwt.NewParser(
		jwt.WithValidMethods([]string{jwt.SigningMethodRS256.Alg()}),
		jwt.WithIssuedAt(),
	)

Also, please add jwt.WithExpirationRequired(), and add a test for that.

[miparnisari]

Thought (not for this PR): i think we shot ourselves in the foot by having all these custom error codes. The code would be much simpler and therefore more secure if we performed all validations in one go:

jwtParser := jwt.NewParser(
		jwt.WithValidMethods([]string{jwt.SigningMethodRS256.Alg()}),
		jwt.WithIssuedAt(),
		jwt.WithExpirationRequired(),
		jwt.WithAudience(config.Audience),
	)
if err != nil  || !token.Valid{
	return nil, errInvalidToken
}

:(