Add built-in function(s) to verify JWT signatures

[tsandall]

The current io.jwt.decode built-in doesn't perform any crypto verification of the signature. As mentioned in #417, it would be nice if OPA could verify JWT signatures.

I could see this working one of a few ways (in order of preference):

1. Add new crypto built-ins to verify signatures independent of JWTs.
2. Modify the existing JWT decode built-in to to support verification (e.g., add a key param that if set would enable verification).
3. Add a new JWT decode built-in that also verifies the signature.