[Improvement] JwksTokenValidator should support multiple JWKS endpoints

### What would you like to be improved?

When a Gravitino deployment needs to accept tokens from more than one OAuth provider (e.g., Azure AD for end-user clients and an internal proxy for service tokens), there is no way to configure multiple JWKS sources. Only one `jwksUri` + `authority` pair can be configured, making multi-provider setups impossible without running separate Gravitino instances.

### How should we improve?

Allow `JwksTokenValidator` to be configured with N JWKS entries, indexed by `gravitino.authenticator.oauth.jwks..uri/issuer/audience/principalFields`. Tokens are routed to the correct entry by matching the JWT `iss` claim — O(1) lookup, no unnecessary cross-provider JWKS calls

Also , The legacy single-provider config keys remain fully backward-compatible.

Start with JwksTokenValidator and trace how the existing single-provider jwksUri and authority settings are loaded. Check the authentication configuration and current validator tests, if present, before defining the multiple-entry lookup by JWT iss. Done means indexed URI, issuer, audience, and principalFields settings work while the legacy keys remain compatible.

Written by the indexing model from the issue text.