fix: drop dependency on jwk-to-pem by using native crypto

[dgl]

This replaces jwk-to-pem with simply using crypto.createPublicKey. This further drops elliptic from the dependency tree, which has known security issues (note this is mostly for hygiene as jwk-to-pem doesn't use the vulnerable code paths, per
Brightspace/node-jwk-to-pem#187).

[netlify]

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	0e02e3f
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6940350f3832b200086b432c

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: kriswest / name: Kris West (0e02e3f)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.65%. Comparing base (c8b2693) to head (0e02e3f).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1283      +/-   ##
==========================================
+ Coverage   80.64%   80.65%   +0.01%     
==========================================
  Files          65       65              
  Lines        4572     4575       +3     
  Branches      776      774       -2     
==========================================
+ Hits         3687     3690       +3     
  Misses        870      870              
  Partials       15       15              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jescalada]

Looks good to me! I added a test that uses crypto.createPublicKey, but it still injects the getJwks stub function for validateJwt. Do you think this is sufficient? @dgl

it('should validate a JWT generated with crypto.createPublicKey', async () => {
  const { privateKey, publicKey } = generateRsaKeyPair();
  const jwk = publicKeyToJwk(publicKey, 'my-kid');

  const tokenPayload = jwt.sign(
    {
      sub: 'user123',
      azp: 'client-id',
      admin: 'admin',
    },
    privateKey,
    {
      algorithm: 'RS256',
      issuer: 'https://issuer.com',
      audience: 'client-id',
      keyid: 'my-kid',
    }
  );

  const getJwksStub = sinon.stub().resolves([jwk]);

  const { verifiedPayload, error } = await validateJwt(
    tokenPayload,
    'https://issuer.com',
    'client-id',
    'client-id',
    getJwksStub
  );

  expect(error).to.be.null;
  expect(verifiedPayload.sub).to.equal('user123');
  expect(verifiedPayload.admin).to.equal('admin');
});

[coopernetes]

LGTM 👍