Verify OAuth2 ID tokens before trusting claims

The compliance portal OAuth callback accepted ID tokens after only
parsing claims, without checking the signature, issuer, audience, or
expiry. Add RS256 verification helpers to the JOSE package, enforce
those checks in ParseIDTokenIdentity, and thread JWKS, issuer, and
client ID through the token response and callback handler.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/complianceportal/v1/oauth_callback_handler.go

@@ -128,7 +128,13 @@ func (h *OAuthCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	identityID, err := oauth2.ParseIDTokenIdentity(tokenResult.IDToken, state.Nonce)
+	identityID, err := oauth2.ParseIDTokenIdentity(
+		tokenResult.IDToken,
+		h.iam.OAuth2ServerService.JWKS(),
+		state.Nonce,
+		h.iam.OAuth2ServerService.Issuer(),
+		tokenResult.ClientID.String(),
+	)
 	if err != nil {
 		h.logger.WarnCtx(ctx, "cannot validate id token", log.Error(err))
 		httpserver.RenderError(w, http.StatusBadRequest, errInvalidOAuthRequest)