Support explicit configuration and discovery of JWS signing algorithm when RS256 is not used by the OP.

[drewtoto]

Describe your feature request

Support explicit configuration of id_token_signed_response_alg in the openid-client issuer.Client configuration. Currently, the properties configured when instantiating a issuer.Client are:

From src/lib/server/auth.ts:

{
  client_id: ...,
  client_secret: ...,
  redirect_uris: ...,
  response_types: ...,  
  [custom.clock_tolerance]: ...,
}

Screenshots (if relevant)

N/A

Implementation idea

Pass configuration object containing id_token_signed_response_alg to issuer.Client in getOIDCClient. Allow this property to be explicitly set via environment variable or obtained from id_token_signing_alg_values_supported field in the issuer metadata during OP discovery when RS256 is not included by the OP.

Proposed data structure to pass to issuer.Client:

{
  client_id: ...,
  client_secret: ...,
  redirect_uris: ...,
  response_types: ...,  
  [custom.clock_tolerance]: ...,
  id_token_signed_response_alg: ...,
}