Fall back to jwks_url if no jwks_uri found in configuration

[joakimnordling]

• Use jwks_url as a fallback if the jwks_uri is not defined in the configuration. This makes it possible to use a broader selection of JWT providers.
• OpenIDConfigurationTypeDef was removed, you can use ConfigurationTypeDef instead.
• Security updates to libraries (aiohttp, idna, cryptography).
• Updated pre-commit hooks.
• Improvements to README.

[lietu]

I might've prioritized jwks_url over jwks_uri because an url is by definition going to be more likely to be accessible where as an uri can be pretty much anything. It's very unlikely however that someone has both properties and that the url is in practice accessible while the uri is not.

[joakimnordling]

The /.well-known/openid-configuration uses jwks_uri and is likely the most used configuration for this library; it's what the library was made for and the default configuration it fetches. Thus defaulting to jwks_uri makes sense to me. The library has been around for over 3 years and our internal need is now the first request to at all add support for jwks_url.

I do agree on the semantics over a URL vs URI, but we can't change what's used in /.well-known/openid-configuration, so I still think the practical use cases dictates what should be the primary one. In the rare case where someone would have both jwks_uri and jwks_url I also prefer the library to be backwards compatible and work the way it used to rather than changing how it works. That being said I hope nobody relies on it and as the library is still in versions 0.x.y this could change in a later release if we see a need for it.