fix: when used with a JWK, the kid value is used to match a JWK k…

[jcouyang]

…id parameter value.

There is a scenario when refresh a token after a key rotation, the kid may be overridden by the session kid which is the old one before rotation
will result in incorrect kid from the new issued access token header

according to RFC7515 4.1.4 kid in token header shall match jwk kid

Related Issue or Design Document

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
  If this pull request addresses a security vulnerability,
  I confirm that I got approval (please contact [email protected]) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

[CLAassistant]

All committers have signed the CLA.