Force users to opt in to accepting unsigned tokens from providers in SG's provider config.

We've got a lot of cloned code in auth/oidc.go that's just to support the ability to verify a trusted JWT token without doing signature validation, which we're doing from the refresh and callback handlers. This is required (at least for backward compatibility), but as per the OIDC spec it's not valid for providers to return unsigned certificates in those situations.

Enable default to the normal signed verification path, and force users to opt in to accepting unsigned tokens from providers in SG's provider config.