[Tracking] JWT requirements

Gathering potential requirements for BCL JWT Apis

from @Tratcher
- read JWTs (and have a plan for eventual encrypted EJWTs)
- Create JWTs (& EJWTs eventually)
- Fetch OIDC metadata(?)

An MVP should consider implementing the following signing algorithms:

HMAC + SHA256
RSASSA-PKCS1-v1_5 + SHA256
ECDSA + P-256 + SHA256

from @blowdart
- Should Validate be separate, or always a function of Parse? (Probably not, but how would you reflect multiple validation errors, or do you stop at the first one)
- Is decrypt a separate step to parse? (Yes from @blowdart)
- Does anyone need to parse an invalid jwt? (someone asked for this if memory serves.)
- Do we support unprotected tokens at all? (No from @blowdart)
- Do we accept or create tokens with a null cipher? (No from @blowdart)
- Do we enable the use of non-crypto board approved curves? (Probably, but with a way to disable, same with deprecated algoritms)
- Is the Json Web Key support a separate, public class?
- Should the signing functions be a separate, pluggable class to allow the use of things like Azure Key Vault?