Support OIDC Discovery in jwt_authn filter

Support OIDC Discovery in jwt_authn filter: The jwt_authn filter should detect if the OIDC IDP supports discovery, and if so, automatically fetch the verification JWKs without configuration

Description: OpenID Connect Discovery allows the relying party (Envoy, in this case) to automatically fetch the JWKs needed to verify a JWT given nothing more than the issuer URL. This is supported by most(?) OIDC IDPs, including Google and Kubernetes clusters.

The way it works is:

1. The issuer sets the iss claim to a publicly-fetchable URL in all the JWTs it issues. For example, for Google-issued JWTs, this is https://accounts.google.com.
2. The relying party checks that the iss claim is a value that it expects.
3. The relying party appends /.well-known/openid-configuration to the URL in the iss claim.
4. The relying party fetches the discovery document using a GET request.
5. The relying party reads the jwks_uri field from the returned JSON document.
6. The relying party fetches the JWKs using another GET request.
7. This process repeats whenever the relying party wants to expire its cached verification JWKs, or when it encounters a token with a known iss claim, but an unrecognized kid (key id) header claim.

Ideally, this would drop the necessary configuration down to something like:

        http_filters:
          - name: envoy.filters.http.jwt_authn
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
                providers:
                  google_provider:
            
                    issuer: https://accounts.google.com
                    remote_jwks:
                      discovery_cluster:  oidc-discovery-cluster # Cluster with settings for making the discovery requests.
                      cache_duration: 3600s
                    audiences:
                      - "my-audience"
                    claim_to_headers:
                    - claim_name: sub
                      header_name: x-google-subject
   
                rules:
                  - match: { prefix: "/" }
                    requires:
                      provider_name: google_provider

Relevant Links:

• https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest