jwks security

PyJWT 2.13.0 fixes the cache-clearing failure behind CVE-2026-48524, but it does not stop PyJWKClient from making a new JWKS request for every JWT carrying an unknown kid value. For Windows-hosted Python APIs that validate bearer tokens against Microsoft Entra ID, Auth0, Okta, or another remote...