Change the key retrieval algorithm in access token offline validation

Right now, the OIDC token validation flow is adapted for WLCG tokens.
The public key is retrieved using the kid hint from the JWT header.

According to the specification, however, the kid field is optional:
https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.4

Furthermore, the following sections describe methods of key selection:
https://www.rfc-editor.org/rfc/rfc7515.html#section-6
https://www.rfc-editor.org/rfc/rfc7515.html#appendix-D

For FTS, the following algorithm is proposed:

1. Retrieve and cache all keys from the JWK endpoint
2. Filter the keys against the optional kid header field
3. Filter the keys against the optional alg header field
4. For each key from the remaining set:
   1. If key successfully decodes the token, stop the process and return valid
   2. If not, continue to the next key
5. Return invalid if no key decodes the token