Support OIDC Discovery in jwt_authn filter

*Support OIDC Discovery in jwt_authn filter*: *The jwt_authn filter should detect if the OIDC IDP supports discovery, and if so, automatically fetch the verification JWKs without configuration*

*Description*:
OpenID Connect Discovery allows the relying party (Envoy, in this case) to automatically fetch the JWKs needed to verify a JWT given nothing more than the issuer URL. This is supported by most(?) OIDC IDPs, including Google and Kubernetes clusters.

The way it works is:
1) The issuer sets the `iss` claim to a publicly-fetchable URL in all the JWTs it issues. For example, for Google-issued JWTs, this is `https://accounts.google.com`.
2) The relying party checks that the `iss` claim is a value that it expects.
3) The relying party appends `/.well-known/openid-configuration` to the URL in the `iss` claim.
4) The relying party fetches the discovery document using a GET request.
5) The relying party reads the `jwks_uri` field from the returned JSON document.
6) The relying party fetches the JWKs using another GET request.
7) This process repeats whenever the relying party wants to expire its cached verification JWKs, *or* when it encounters a token with a known `iss` claim, but an unrecognized `kid` (key id) header claim.

Ideally, this would drop the necessary configuration down to something like:
```
http_filters:
- name: envoy.filters.http.jwt_authn
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
providers:
google_provider:

issuer: https://accounts.google.com
remote_jwks:
discovery_cluster: oidc-discovery-cluster # Cluster with settings for making the discovery requests.
cache_duration: 3600s
audiences:
- "my-audience"
claim_to_headers:
- claim_name: sub
header_name: x-google-subject

rules:
- match: { prefix: "/" }
requires:
provider_name: google_provider
```

*Relevant Links*:
* https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest