feat(security): load verify keys from auth JWKS

Core finds the key by the token kid and loads the JWKS again for an
unknown kid, at most every 10 s. JWT_PUBLIC_KEY is used only until the
first JWKS load works, so a key removed from the JWKS cannot verify
later. While that key still works, requests do not wait for a slow
Auth.

src/main/resources/application.yml

@@ -35,7 +35,8 @@ management:
       show-details: never
 security:
   jwt:
-    public-key: ${JWT_PUBLIC_KEY}
+    public-key: ${JWT_PUBLIC_KEY:}
+    jwks-url: ${JWT_JWKS_URL:}
 app:
   cors:
     allowed-origins: "https://tbp.andreas-dahm.eu"