Workload ID: SPIFFE JWT OIDC IDToken Compatability

[strideynet]

As of #38930, Teleport Workload ID will support issuing JWT SVIDs.

We can make these more useful by also adding compliance with the OIDC Discovery specification.

This will involve:

• Adding an iss to the token claims
• Hosting an OpenID configuration document at the well-known location based on that iss
• Publishing the SPIFFE CA JWT public keys as part of a JWKS format document.

Decisions:

• Should we reuse the "iss" value strategy we use for the AWS OIDC integration, and hence extend the existing JWKS document to also include the SPIFFE CA JWT public keys? Or should we have a distinct issuer e.g spiffe.example.teleport.sh or example.teleport.sh/spiffe ?
• Should we expect to have problems where the proxies have multiple domain names and there isn't a clear issuer to select.

[strideynet]

https://openid.net/specs/openid-connect-discovery-1_0.html

The issuer value returned MUST be identical to the Issuer URL that was used as the prefix to /.well-known/openid-configuration to retrieve the configuration information. This MUST also be identical to the iss Claim value in ID Tokens issued from this Issuer.