jwt_authn: Add logic to refetch JWT on KID mismatch

[arulthileeban]

Commit Message: jwt_authn: Add logic to refetch JWT on KID mismatch Additional Description: Minimal implementation driven through config to force filter to refetch JWKS when extracted JWT's KID does not match with cached JWKS's KID.

Risk Level: Low Testing: Unit/Integration Docs Changes: Done Release Notes: Done Partially fixes #14557

[repokitteh-read-only[bot]]

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/). envoyproxy/api-shepherds assignee is @markdroth CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

:cat:

Caused by: https://github.com/envoyproxy/envoy/pull/36458 was opened by arulthileeban.

see: more, trace.

[alyssawilk]

/wait on CI (@tyxia please remember to use wait tags to avoid PRs showing up as stale)

[KBaichoo]

/wait

Seems like this needs a main merge + addressing of some comments.

[arulthileeban]

@markdroth @tyxia Apologies for the delay. I've made changes as discussed, which are also documented in the API docs (code is also added for disallowing multiple fetches in parallel, just not documented).

I'll add tests for the new code if this looks good to you.

[markdroth]

/lgtm api

[adisuissa]

@tyxia PTAL.