Separate and refactor key infrastructure

[johnabass]

The keys package is really showing its age. Not only does it only support PEM-encoded keys, but it also has significant semantic differences from the way JWK keys work:

• Only RSA keys are supported
• The key's purpose is expected to be configured rather than obtained from the key itself
• The refresh mechanism is primitive and lacks support for HTTP caching headers and expiry set in the keys themselves

I think we should create a new repo that brings this functionality up-to-date. In addition to supporting JWKs and the semantics of using JWKs, it also needs better refresh features like backoffs and retries.

Most of the functionality we need is in https://pkg.go.dev/github.com/lestrrat-go/jwx/jwk, which makes a good starting point.

This work would be part of #120

[denopink]

closed by #141