Interfaces and services for JWK management

[woodruffw]

This adds the initial set of interfaces and services (and a small warehouse oidc CLI) for JSON Web Key (JWK) management.

Some design notes:

• JWKs come in sets, and are keyed by their OIDC provider. For now, GitHub is the only provider Warehouse knows about.
• The current implementation stashes the JWKs in Redis. I'm not 100% sure if this is the best place for them, so please let me know if somewhere else is better.
• The current implementation adds a periodic (daily) job for refreshing the JWKs from each service. A user standing up a fresh instance of Warehouse can also manually fetch the JWKs by running warehouse oidc update-oidc-jwks.
• I'm not sure whether or not it also makes sense to cache the OIDC configuration (and periodically re-fetch it). The only thing I can currently think of that we might want from it is the issuer key, but we should probably keep that hardcoded anyways.

Needs:

• More documentation
• Unit tests

Closes #10620.

[woodruffw]

Updated the warehouse oidc CLI now that we do FOFU:

Usage: python -m warehouse oidc [OPTIONS] COMMAND [ARGS]...

  Manage the Warehouse OIDC components.

Options:
  -h, --help  Show this message and exit.

Commands:
  get-key         Return the JWK for the given provider's...
  prime-provider  Update Warehouse's JWK sets for the given...

[woodruffw]

I haven't started on tests yet, but this should be good for another review pass.

[di]

Overall looks good. We need to make sure we're emitting meaningful metrics at the right places. We probably want to use sentry_sdk.capture_message for the errors instead of logging them (would be nice to make this just output to the logger in development).

[woodruffw]

cc @di: Let me know if this looks reasonable for the factory.

(I cargo-culted the __eq__ implementation from TokenServiceFactory -- I assume it's necessary to help find_service disambiguate the factory-produced services?)

[di]

Some slight refactoring suggestions and one overall thought: Should we make this an OIDCProviderService instead? I don't see a need for having separate JWK service and OIDC service (with an interface like .verify(token)) for the same provider.

[woodruffw]

Should we make this an OIDCProviderService instead?

Yep, that makes sense to me! I'll make that change.

[woodruffw]

Dependencies failure in the CI looks unrelated to these changes:

# install ipython if enabled
/opt/hostedtoolcache/Python/3.8.9/x64/bin/pip-compile --upgrade --allow-unsafe -o /tmp/tmp.skKABnHln0/deploy.txt requirements/deploy.in > /dev/null
Traceback (most recent call last):
  File "/opt/hostedtoolcache/Python/3.8.9/x64/bin/pip-compile", line 8, in <module>
    sys.exit(cli())
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/click/core.py", line 1128, in __call__
    return self.main(*args, **kwargs)
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/click/core.py", line 1053, in main
    rv = self.invoke(ctx)
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/click/core.py", line 1395, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/click/core.py", line 754, in invoke
    return __callback(*args, **kwargs)
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/click/decorators.py", line 26, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/piptools/scripts/compile.py", line 342, in cli
    repository = PyPIRepository(pip_args, cache_dir=cache_dir)
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/piptools/repositories/pypi.py", line 106, in __init__
    self._setup_logging()
  File "/opt/hostedtoolcache/Python/3.8.9/x64/lib/python3.8/site-packages/piptools/repositories/pypi.py", line 455, in _setup_logging
    assert isinstance(handler, logging.StreamHandler)
AssertionError
make[1]: *** [Makefile:121: deps] Error 1
make[1]: Leaving directory '/home/runner/work/warehouse/warehouse'
make: *** [Makefile:139: github-actions-deps] Error 2
Error: Process completed with exit code 2.