Still references potentially vulnerable Microsoft.AspNetCore.Authentication.JwtBearer 5.0.0 package

[Peter-Juhasz]

Which version of Microsoft Identity Web are you using?
1.20.0

Where is the issue?
Package doesn't support .NET 6 yet and references a vulnerable .NET 5 package, and our build breaks on dependency vulnerability scan.

Repro

<PackageReference Include="Microsoft.Identity.Web" Version="1.20.0" />

or

<PackageReference Include="Microsoft.Identity.Web" Version="1.*" />

Expected behavior
No vulnerable transitive dependencies.

Actual behavior
dotnet list App.sln package --vulnerable --include-transitive

Project `App` has the following vulnerable packages
   [net6.0]: 
   Transitive Package                                   Resolved   Severity   Advisory URL                                     
   > Microsoft.AspNetCore.Authentication.JwtBearer      5.0.0      Moderate   https://github.com/advisories/GHSA-q7cg-43mg-qp69

Possible solution
Upgrade all references to .NET 6.

[jennyf19]

Included in 1.21.0 release