Offer a built-in JWKS endpoint to support encrypted tokens

Wilson doesn't support JWE yet, but at this moment, we'll probably want to offer a JWKS endpoint directly in the OIDC middleware (to allow the identity provider to retrieve the public key(s) used to encrypt the identity tokens) and in the JWT bearer middleware (for the access tokens)

Related specs:
- JWK/JWKS: http://tools.ietf.org/html/draft-ietf-jose-json-web-key-31
- OIDC dynamic registration (though dynamic registration is not directly needed to support this feature, it's the only OIDC specs that contains valuable resources on JWKS): http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata

Related tickets:
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/46
- https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/120 (/cc @MonkeyJamboree)