Multiple rsa keys

[dylantack]

Fixes #950

Description of the Change

This adds support for multiple RSA keys via the OIDC_RSA_PRIVATE_KEYS_INACTIVE setting.
Additionally, jwks_uri has Cache-Control header as recommended by the OpenID spec.

Checklist

• PR only contains one change (considered splitting up PR)
• unit-test added
• documentation updated
• CHANGELOG.md updated (only for user relevant changes)
• author name in AUTHORS

[dylantack]

To be very precise about the Cache-Control header, the spec only mentions it in the context of encryption keys, not signing keys. However jwks_uri would be the same resource for both, and I think even for signing the max-age is valuable information for the verifier. Without it, the verifier doesn't have any guidance on how often to re-check for revoked keys.

Here are some examples from jwks_uri on popular ID providers:

Auth0:
Cache-Control: public, max-age=15, stale-while-revalidate=15, stale-if-error=15

Firebase Auth:
Cache-Control: public, max-age=22159, must-revalidate, no-transform

Okta:
cache-control: max-age=3293198, must-revalidate

Azure Active Directory B2C:
Cache-Control: max-age=86400, private

So it seems like there's quite a bit of variation; I have defined OIDC_JWKS_MAX_AGE_SECONDS with a default of 1 hour.

[codecov]

Codecov Report

Merging #978 (40df294) into master (59ab199) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master     #978   +/-   ##
=======================================
  Coverage   96.56%   96.56%           
=======================================
  Files          31       31           
  Lines        1716     1718    +2     
=======================================
+ Hits         1657     1659    +2     
  Misses         59       59           

Impacted Files	Coverage Δ
oauth2_provider/settings.py	100.00% <ø> (ø)
oauth2_provider/views/oidc.py	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 59ab199...40df294. Read the comment docs.

[n2ygk]

Nice! Thanks.