Feature: Add support for JWKS

Right now, you can use a single JWT public key to validate access tokens, which is an improvement over plain credentials already. What would be even better (and aligned with web standards), would be support for [JSON Web Key Sets (JWKS)](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-key-sets).
Such a key set is an array of public keys used to issue tokens; on its own, that allows rotating the public keys already. More importantly though, the JWKS is usually available on a public URL, which in turn can be located using the `jwks_uri` property returned by the [standardised OpenID Discovery Endpoint](https://swagger.io/docs/specification/v3_0/authentication/openid-connect-discovery/) (specified as `{host}/.well-known/openid-configuration`.)

In practice, this means users could configure their authorization server host or discovery URL, the service retrieves (and caches) the metadata document from the endpoint, reads the JWKS URI from the response, retrieves (and caches) the public keys from this URI, and validates tokens against each key in the set.

JWKS and OpenID Discovery is supported by all major authentication providers and client libraries, so this would enable a lot of people to configure the URL once, and don't have to worry about key rotations and expiration anymore.

No files, tests, or entry points are named. Start by locating the existing single-JWT-public-key validation and configuration, then trace how discovery metadata, JWKS retrieval, caching, key rotation, and token validation would fit together; done means users can configure a host or discovery URL and validate tokens against the discovered key set.

Written by the indexing model from the issue text.