Pulsar Authentication should support rotation of Validation keys e.g. Public keys used in JWT validation

**Is your enhancement request related to a problem? Please describe.**
A common practice for security is to rotate keys used in encryption as well as token validation.
During the rotation the cryptographic functions temporarily will need to support data signed/encrypted with the
old keys as well as those signed/encrypted with the new keys.

**Describe the solution you'd like**
Pulsar authentication methods that rely on cryptographic keys e.g. Authentication with JWT Tokens
should support more than one cryptographic key with the ability to reload new keys "on the fly".

See for example
https://github.com/apache/pulsar/blob/master/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L68

**Describe alternatives you've considered**
Considered (in a Kubernetes context) provisioning new brokers with a new key and gradually rolling those out - however it means that previous tokens (encrypted) with old keys won't be supported during this time.
This could be picked up by the client and cause them to refresh their token but this seems onerous and complex to code and test.