fix: more resilient checks in verify signed attachments

[dbluhm]

Fixes #2608.

This PR makes the signed attachment verification a bit more resilient. According to RFC 7515, there's no reason for us to strictly expect a kid to be present in the jwk and we can verify that the jwk corresponds to the kid in the header trivially. In short, the previous rigidity was unnecessary. This corrects that.

[dbluhm]

@swcurran acknowledging that we're somewhere on the verge of 0.11.0, I have no preference for whether this ends up in this release or a follow up patch release (I'll have other bigger changes queued up for a patch for things like did:peer:2 anyways).

[usingtechnology]

@dbluhm - in Thailand so will not be able to review. Back late November.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[swcurran]

@andrewwhitehead — since @usingtechnology is not around, can you please take a look at this one? Looks pretty straight forward to me :-)

[swcurran]

Looks like the only change is to add a check for the kid before using it, instead of just using it. Right?

[dbluhm]

@swcurran pretty much, yep