Support for SD-JWT+KB

[timothee-haudebourg]

Description

Brings support for an optional key binding JWT in the SdJwt type. I decided to go with an optional KB instead of a brand new SdJwtKb type because it seemed more flexible in the case a KB is not required by the audience.

Other changes

I added a few convenience functions/methods to JWT claims, so they can be verified more easily.

Tested

You will find two new tests in the kb module. One builds, signs and verify an SD-JWT+KB, while the other tries to verify an external SD-JWT+KB (found in the spec).

[Juliano1612]

LGTM!
Question: sd_hash should be validated automatically during .decode_kb().verify() or should we let it for the caller?

[timothee-haudebourg]

The verify method is on the Jws type, so it doesn't really have any way of knowning it's verifying an KB-JWT. There are ways of working around it, like defining a newtype, or playing with ssi's verification traits... but tbh calling sd_hash.verify manually is fine I think. Maybe I'll regret it, but let's try it for a while see if it's really a bother.