fix: enable rust_crypto backend for jsonwebtoken 10, ignore RSA advisory

jsonwebtoken v10 requires an explicit CryptoProvider. Enable rust_crypto
feature since we only use HMAC-SHA256. Ignore RUSTSEC-2023-0071 (RSA
timing side-channel) as transitive dep we never invoke.

Author: zircote