[Dependencies] Add cryptography backend for python-jose

[judysng]

Changes

• Use python-jose[cryptography] instead of just python-jose to use the cryptography backend instead of ecdsa backend
  • Doing this because of this CVE for edcsa that they don't intend to fix: https://github.com/aws/aws-parallelcluster-ui/security/dependabot/29
  • ecdsa will still be installed, but will be unused, since cryptography will be used instead: https://pypi.org/project/python-jose/

How Has This Been Tested?

Ran pytest, deployed, created/deleted cluster

In order to increase the likelihood of your contribution being accepted, please make sure you have read both the Contributing Guidelines and the Project Guidelines

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[gmarciani]

Minor: let's add a comment here specifying why we are selecting the specific backend.
Explanation is in the official python-jose page: https://pypi.org/project/python-jose/

[dreambeyondorange]

Another potential solution is to move a production maintained package for this as they mention in this issue wazuh/wazuh#21590. I think we should move away from python-jose, since we are likely to run into this issue again with no resolution

[judysng]

Thanks Ryan for this solution, I think for now we will use this method since it would require more effort and possible appsec reviews to change the library whereas for now we just want to mitigate the CVE. I created a task in the backlog though

[gmarciani]

Installing python-jose with a specific backend was a very good approach to bypass the edcsa CVE.
Good job!