Migrate OpenID plugin off deprecated authlib.jose to joserfc

The OpenID web app plugin imports the deprecated authlib.jose module, which raises an AuthlibDeprecationWarning at import time. Authlib recommends migrating to joserfc (the warning notes compatibility will hold only until version 2.0.0).

### Scope

- Affected file: src/ai/backend/manager/plugin/openid/webapp.py (single usage site).
- Deprecated usage: authlib.jose.jwt.decode for OIDC id_token verification, coupled with JWKS signature checking and CodeIDToken (authlib.oidc.core) claim validation. Reimplement this with joserfc (JWT decode + JWKS handling + OIDC claim validation) and add joserfc as a dependency.
- Out of scope: the remaining authlib usages (AsyncOAuth2Client, generate_token) are not deprecated and stay; the authlib dependency itself is retained.
- Verify regression with the OpenID component tests under tests/component/openid/.

JIRA Issue: BA-6575

Start in src/ai/backend/manager/plugin/openid/webapp.py, focusing on the authlib.jose.jwt.decode usage and its JWKS and CodeIDToken validation flow. Add the joserfc dependency while leaving the other authlib usages unchanged, then run the OpenID component tests under tests/component/openid/ to verify the migration.

Written by the indexing model from the issue text.