Make google-cloud-auth safer by removing dependencies flagged as vulnerable by rustsec

Based on https://github.com/googleapis/google-cloud-rust/issues/3934, we need to make the auth library clean of security warnings. This is currently being caused mainly by the id token feature (more specifically the id token verification feature), which pull the `jsonwebtoken` crate, which has `rsa` in it's dependency chain. Vulnerability report: https://rustsec.org/advisories/RUSTSEC-2023-0071

We also include `rsa` as dev-dependency for tests, to generate a real certificate based on some test prime numbers. I think we can replace this with `ring` https://docs.rs/ring/latest/ring/rsa/struct.KeyPair.html#method.from_components. We already use `ring` as a crypto provider in the `rustls` crate.

Current plan:

- [x] Gate `idtoken` behind a rust feature. https://github.com/googleapis/google-cloud-rust/pull/3961
- [x] ~Use `aws_lc` backend instead of `rust_crypto` for `jsonwebtoken`. This removes dependency on `rsa`, but customers don't like the `aws_lc` backend, since is not written in pure rust, so this is just temporary and gated behind the `idtoken` feature. https://github.com/googleapis/google-cloud-rust/pull/3962~ We are gonna wait for `rsa` to be fixed. For the time being, `idtoken` is gated behind a feature.
- [ ] Replace `rsa` usage with `ring` for tests.
- [ ] Move away from `jsonwebtoken`. We don't have a candidate crate yet, but maybe some code can be written to check for signatures using `ring`. https://github.com/googleapis/google-cloud-rust/pull/3960