chore: upgrade to golang-jwt 3.2.1 to fix CVE-2020-26160

[jdstrand]

CVE-2020-26160[0] is an access restriction bypass under certain
circumstances when validating audience checks. The original
dgrijalva/jwt-go project is no longer maintained[1] and will not be
issuing a fix for this CVE[2]. Instead, they have transferred ownership
to golang-jwt/jwt[2][3][4].

The following was performed:

1. update chronograf and jsonweb to import golang-jwt/jwt
2. go mod edit -require github.com/golang-jwt/jwt@v3.2.1+incompatible
3. go mod edit -droprequire github.com/dgrijalva/jwt-go
4. go mod tidy
5. make
6. make test

Note: 1.x is not affected since 1.8.4rc and 1.9.0rc pulled in a prerelease version of dgrijalva/jwt-go v4 that had the fix. We should move 1.x to golang-jwt/jwt, but that s for future maintenance and not a security fix.

References:
[0] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26160
[1] dgrijalva/jwt-go#462
[2] dgrijalva/jwt-go#463
[3] https://github.com/dgrijalva/jwt-go/blob/master/README.md
[4] https://github.com/golang-jwt/jwt

• CHANGELOG.md updated with a link to the PR (not the Issue)
• Well-formatted commit messages
• Rebased/mergeable
• Tests pass
• Signed CLA (if not already signed)

[williamhbaker]

LGTM!

[jdstrand]

Thanks for the review!