Move JWT token into metadir dokuwiki#4239

Moving JWT token store away from cache directory,
to have long-lived authentication files properly stored.

Using sha256 on the files instead of md5, to help mitigate
potential hash collision as filenames are based on username.

Author: mauli

inc/JWT.php

@@ -179,6 +179,10 @@ public function getIssued()
      */
     public static function getStorageFile($user)
     {
-        return getCacheName($user, '.token');
+        global $conf;
+        $hash = hash('sha256', $user);
+        $file = $conf['metadir'] . '/jwt/' . $hash[0] . '/' . $hash . '.token';
+        io_makeFileDir($file);
+        return $file;
     }
 }