Apply UseWhitelist to JWTs without a kid header

The purpose of this release is to fix a security vulnerability where Options.UseWhitelist was bypassed for JWTs without a kid header. Keys excluded by the whitelist, such as keys with a use of enc, could verify JWTs without a kid header. JWTs without a kid header are now also checked against the JWK alg parameter.

See GHSA-29f5-h73v-w8j9 for details. All users of v3.5.0 through v3.9.1 who set Options.UseWhitelist should upgrade.

Thank you @HotWater-015 for the report!

Relevant pull requests:

• #157