support setting a client JWKs URL explicitly

this enables overriding the automically default that is generated based
on the OIDCPublicKeyFiles setting (i.e. <redirect_uri>?jwks=rsa>) using
OIDCClientJwksUri in the Apache config file using or client_jwks_uri in
the provider/client .conf file
support A128KW/A256KW CEKs and A256CBC-HS512 alg for encrypted JWTs

add support for AES Wrapped Content Encryption Keys and AES256 CBC
encrypted JWTs
improve documentation on OIDCRedirectURI

emphasize that it must not point to any actual user facing content