The JWK retriever does not remove stale JWK from cache

[chunlongliang-ibm]

Liberty client caches JWKs for reuse, and fetches and caches new JWKs when JWT is signed with new JWK (new kid or x5t). While fetching new JWKs, Liberty should clean up stale or old JWKs.

There is a regression that disable the cleanup logic.

The code need to be fixed is JwkRetriever.java class

1. Remove old jwk (not immediately, so token signed with old key can still be verified)
2. have an configuration option to remove old key immediately upon new key is downloaded (in case private key is stolen).

[ayoho]

Need to investigate to see if this is still an issue.

[brutif]

looks like the issue is JwkRetriever.parseKeyText calls Jwkset.add(..) but the cleanup algo only runs if JwkSet.addJWK(..) is called.