➕(backend) handle JSON Object Signing and Encryption (JOSE)

joserfc has been chosen as the dependency to implement a JWKs endpoint in the
Django app. While there are several alternatives available such as pyjwt,
python-jose, jwcrypto, etc., joserfc has been opted for the following reasons:

- Cryptography: Although using only cryptography is feasible, its
  interface/API is not as user-friendly.

- pyjwt: While pyjwt is popular, it lacks support for JWK and JWE, which are
  essential for the requirements.

- python-jose: The latest release of python-jose was in 2021, and the
  project seems less active compared to other alternatives.

- Authlib: Authlib is the second most popular library after pyjwt and seems
  modern with an active community. However, the parts relevant to the use case
  were extracted into a relatively new package named joserfc.

- joserfc: Although joserfc has fewer stars compared to Authlib, it was
  extracted from Authlib, which has more than 4k stars, indicating a solid
  foundation.

While the low star count of joserfc might raise concerns about its stability, it
is believed to be worth considering its addition. Adding Authlib and refactoring
later, once they finish migrating to joserfc, is a possibility to address
any potential regressions.

One of my concern is that joserfc hasn’t been released in a major version yet.

This commit is a work in progress, and further evaluation and testing are
needed before finalizing the integration of joserfc into the project.

src/backend/pyproject.toml

@@ -47,6 +47,7 @@ dependencies = [
     "nested-multipart-parser==1.5.0",
     "psycopg[binary]==3.1.18",
     "PyJWT==2.8.0",
+    "joserfc==0.9.0",
     "requests==2.31.0",
     "sentry-sdk==1.45.0",
     "url-normalize==1.4.3",