feat(rivetkit): Support external OIDC/JWT validation inside onAuth lifecycle hooks

Rivet works great with Better Auth for standard setups, but things get messy when we use a separate corporate or open-source identity provider (like Rauthy or Keycloak).Right now, if an external app sends an OIDC access token (JWT) to a Rivet Actor, there is no built-in way to validate it. We have to write manual code inside our actor/edge handlers to fetch the /.well-known/openid-configuration, download the JWKS keys, handle the crypto verification, and manage key caching. Doing this manually for every project introduces a lot of boilerplate and edge.

It would be awesome to have a simple utility inside rivetkit's onAuth hook that can declaratively verify external JWTs.