upgrade jwt version from dgrijalva/[email protected] to golang-jwt/jwt v3.2.1

[nburuzul]

github.com/go-kit/kit v0.10.0 internally uses older version of jwt library [github.com/dgrijalva/[email protected]+incompatible].
github.com/go-kit/kit v0.12.0 is upgraded to use community jwt library [github.com/golang-jwt/jwt v3.2.1]

problem with dgrijalva/jwt-go:
dgrijalva/jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to golang-jwt at version 3.2.1