Authentication plugin doesn't support overlapping kid values

[lleadbet]

Describe the bug

Given a configuration that looks like:

# testing jwks
- url: https://test/default
   issuer: https://test_aud
# staging jwks
- url: https://staging/default
   issuer: https://staging_aud

Whereby both the staging and testing JWKS endpoints include a shared kid value (e.g. key1).

With this configuration, the auth plugin will only validate against the first in the list (in this case, the testing jwks). It may be necessary to support multiple of the same kid in cases of staging/testing environments, where there's a fallback kid for both that shares the same identifier.

To Reproduce

Given this token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleTEifQ.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE1MTYyMzkwMjIyLCJhdWQiOiJ0ZXN0aW5nIn0.DVPtUcLYlgEFE2OjLEJ6LQp6-Sflm9rJKHUqXCUFV8g

And these JWKS files:

Testing JWKS

{
    "keys": [{
        "alg": "HS256",
        "k": "dGVzdA==",
        "use": "sig",
        "kty": "oct",
        "kid": "key1"
    }]
}

Staging JWKS

{
    "keys": [{
        "alg": "HS256",
        "k": "dGVzdGluZw==",
        "use": "sig",
        "kty": "oct",
        "kid": "key1"
    }]
}

And lastly, this config:

authentication:
  jwt:
    jwks:
      - url: file://${env.PWD}/jwks_test.json
        aud: testing
      - url: file://${env.PWD}/jwks_staging.json
        aud: staging

You'll first see the token failing- the last entry takes precedence. Swapping the two config options results in it working.

Expected behavior
The kid is not only checked, but the right JWKS is used based on the aud, or the token is checked against all possible matches vs. the first one.

Desktop (please complete the following information):

• OS: macOS
• Version [e.g. 22]: 1.15.1