Make 'kid' optional for private_key_jwt client assertion

[Gachapen]

There is seemingly no way to exclude the kid from the client assertion JWT header. It either has the value of the kid in the initial JWK provided in the JWKS to the client, or it is automatically constructed (in the 'jose' library?) if it is missing. This might be a problem in cases where the OP does not indicate how to derive the kid, because if we provide the wrong kid, the authentication will fail.

Based on what I understand from the specs, there should be no problem with making it optional, so could we add an option to exclude it from the JWT?

[panva]

https://github.com/panva/node-openid-client/releases/tag/v4.9.1 fixes this issue. Unless a kid is explicitly present in the jwks passed to a Client constructor it will not be present in the issued assertions.

[Gachapen]

Great. Thank you.