Based on #3934, we need to make the auth library clean of security warnings. This is currently being caused mainly by the id token feature (more specifically the id token verification feature), which pull the jsonwebtoken crate, which has rsa in it's dependency chain. Vulnerability report: https://rustsec.org/advisories/RUSTSEC-2023-0071

We also include rsa as dev-dependency for tests, to generate a real certificate based on some test prime numbers. I think we can replace this with ring https://docs.rs/ring/latest/ring/rsa/struct.KeyPair.html#method.from_components. We already use ring as a crypto provider in the rustls crate.

Current plan:

• Gate idtoken behind a rust feature. impl(auth): make idtoken a feature #3961
• Use aws_lc backend instead of rust_crypto for jsonwebtoken. This removes dependency on rsa, but customers don't like the aws_lc backend, since is not written in pure rust, so this is just temporary and gated behind the idtoken feature. impl(auth): change jsonwebtoken crypto provider #3962 We are gonna wait for rsa to be fixed. For the time being, idtoken is gated behind a feature.
• Replace rsa usage with ring for tests.
• Move away from jsonwebtoken. We don't have a candidate crate yet, but maybe some code can be written to check for signatures using ring. refactor(auth): move from jsonwebtoken crate to biscuit #3960