update verifyJwt with ignoreExpiry flag

[stevehu]

This is used by light-spa-4j stateless-auth module to check csrf token from JWT and csrf token from header even JWT has expired already.

With this change, I have removed oauthHttp2Support from security.yml for OAuth 2.0 provider communication. The enableHttp2 flag now is in client.yml which is the right place for each OAuth service configuration section.