fix: prevent JWT attacks by spoofed keyIDs

[paullatzelsperger]

What this PR changes/adds

This PR fixes a security issue, where an attacker would do the following:

• obtain a legit VC issued to Bob (i.e. Bob's DID is the credentialSubject.id)
• generate a VP using Bob's DID as iss claim and holder property
• sign this seemingly legit VP with the attacker's private key
• put the key-ID of the attacker's key as kid header in the VP-JWT token

This caused the public key resolver to take the (malicious) key-ID "at face value", and resolve the public key from it.

This is a problem, because that would resolve the ATTACKER's public key, instead of the LEGIT HOLDER's public key!

Why it does that

prevent impersonation attacks

Further notes

List other areas of code that have changed but are not necessarily linked to the main feature. This could be method
signature changes, package declarations, bugs that were encountered and were fixed inline, etc.

Linked Issue(s)

Closes # <-- insert Issue number if one exists

Please be sure to take a look at the contributing guidelines and our etiquette for pull requests.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.05%. Comparing base (7f20ba5) to head (8244efa).
Report is 255 commits behind head on main.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4186      +/-   ##
==========================================
+ Coverage   71.74%   75.05%   +3.30%     
==========================================
  Files         919     1013      +94     
  Lines       18457    20557    +2100     
  Branches     1037     1161     +124     
==========================================
+ Hits        13242    15429    +2187     
+ Misses       4756     4620     -136     
- Partials      459      508      +49     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.