[SDK-3503] Add *_jwt token endpoint auth methods

[adamjmcgrath]

Description

Adding the private_key_jwt and client_secret_jwt token endpoint authentication methods to the SDK.

Usage

// client_secret_jwt
app.use(
  auth({
    clientID: '...',
    secret: '...',
    issuerBaseURL: '...',
    clientSecret: '...',
    authorizationParams: {
      response_type: 'code',
    },
    clientAuthMethod: 'client_secret_jwt',
  })
);

// private_key_jwt
app.use(
  auth({
    clientID: '...',
    secret: '...',
    issuerBaseURL: '...',
    authorizationParams: {
      response_type: 'code',
    },
    clientAssertionSigningKey: '-----BEGIN RSA PRIVATE KEY-----\nMIIEo...PgCaw\n-----END RSA PRIVATE KEY-----',
  })
);

References

https://openid.net/specs/openid-connect-core-1_0-15.html#ClientAuthentication

Testing

run npm run start:example -- private-key-jwt or npm run start:example -- client-secret-jwt

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master

[lgtm-com]

This pull request introduces 2 alerts when merging 946fb88 into b03615c - view on LGTM.com

new alerts:

• 2 for Missing rate limiting

[lgtm-com]

This pull request introduces 2 alerts when merging 959de09 into b03615c - view on LGTM.com

new alerts:

• 2 for Missing rate limiting

[lgtm-com]

This pull request introduces 2 alerts when merging b845ae0 into b03615c - view on LGTM.com

new alerts:

• 2 for Missing rate limiting

[lgtm-com]

This pull request introduces 2 alerts when merging c838f8a into b03615c - view on LGTM.com

new alerts:

• 2 for Missing rate limiting

[lgtm-com]

This pull request introduces 2 alerts when merging 213a177 into b03615c - view on LGTM.com

new alerts:

• 2 for Missing rate limiting