Feature request: Add support for private_key_jwt as an alternative to client_secret

Microsoft is strongly pushing to use x509 based client authentication, see: https://devblogs.microsoft.com/microsoft365dev/client-secret-expiration-now-limited-to-a-maximum-of-two-years

It would be great if the ODIC/JWT auth plugin in Vault could support this part of the OIDC spec: https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

I would assume that Vault would generate the private key and never expose it to the operator.
The public key should be retrievable via UI and API.

Thanks,
Tyler

No files, tests, or entry points are named. Start by reading the linked OpenID Connect Client Authentication specification and examining the plugin's existing JWT/OIDC authentication behavior; done means private_key_jwt is supported, the private key remains inaccessible to operators, and the public key is retrievable through the UI and API.

Written by the indexing model from the issue text.