feat!: remove custom JWT decoding

[robrap]

Removes the ecommerce custom JWT decoding, and replaces with the simple decoding from the edx-drf-extensions library. Example replacements:

• from ecommerce.extensions.api.handlers import jwt_decode_handler =>
• from edx_rest_framework_extensions.auth.jwt.decoder import configured_jwt_decode_handler
  Or
• 'ecommerce.extensions.api.handlers.jwt_decode_handler' =>
• 'edx_rest_framework_extensions.auth.jwt.decoder.jwt_decode_handler'

Note that monitoring showed that all jwt_decode_handler calls were registering as ecom_jwt_decode_standard, and none as ecom_jwt_decode_custom, which shows that the custom code was no longer being used. The additional JWT_ISSUERS can now be cleaned up as a consequence of this change. Here is a private link for edx.org that can be used to confirm readiness for this change: https://onenr.io/0MR28Nrm2QY.

Other fixes in this PR:

• Codecov was fixed to use the github action. It is not yet marked as required, because it was failing by too much.
• Many constraints were dropped and many libraries were upgraded.
• Some test improvements were required to work with the updated libraries.

Before merge:

• Land fix: remove JWT_DECODE_HANDLER override openedx-unsupported/configuration#6921
• Manual test of purchase in stage to confirm settings change.
• Once stage purchase is complete, ensure https://github.com/edx/edx-internal/pull/8163 lands before merging/deploying this to production.
• Manual test of crispy_forms locally (or in stage, but before prod)

Being reviewed under private ticket REV-3543.

⛔️ DEPRECATION WARNING

This repository is deprecated and in maintainence-only operation while we work on a replacement, please see this announcement for more information.

Although we have stopped integrating new contributions, we always appreciate security disclosures and patches sent to security@edx.org

Anyone internally merging to this repository is expected to release and monitor their changes; if you are not able to do this DO NOT MERGE, please coordinate with someone who can to ensure that the changes are released.

Required Testing

• Before deploying this change, complete a purchase in the stage environment.
  (^ We can remove that manual check once REV-2624 is done and the corresponding e2e test runs again)

Description

Describe what this pull request changes, and why these changes were made. How will these changes affect other people, installations of edx, etc.?
Please include links to any relevant ADRs, design artifacts, and decision documents. Make sure to document the rationale behind significant changes in the repo, per OEP-19, and can be
linked here.

Useful information to include:

• Which edX user roles will this change impact? Common user roles are "Learner", "Course Author", "Developer", and "Operator".
• Include screenshots for changes to the UI (ideally, both "before" and "after" screenshots, if applicable).
• Provide links to the description of corresponding configuration changes. Remember to correctly annotate these changes.

Supporting information

Link to other information about the change, such as Jira issues, GitHub issues, or Discourse discussions.
Be sure to check they are publicly readable, or if not, repeat the information here.

Testing instructions

Please provide detailed step-by-step instructions for testing this change; how did YOU test this change?

Other information

Include anything else that will help reviewers and consumers understand the change.

• Does this change depend on other changes elsewhere?
• Any special concerns or limitations? For example: deprecations, migrations, OpenEdx vs. edx.org differences, development vs. production environment differences, security, or accessibility.

[robrap]

Note to reviewer:

I used https://openedx.atlassian.net/wiki/spaces/AC/pages/1001521320/Python+Package+Changelogs to verify all changes that seemed like major version upgrades.

The change that required some updates (besides the JWT work) was around crispy_forms.

[request] Someone who knows, please spot check (or better) some views using crispy_forms.

The following are notes on all of the changes I verified:

bleach==5.0.1 => 6.0.0 (ok if tests pass)
cachetools==4.2.2 => 5.3.0 (requires Python 3.7+)
charset-normalizer==2.1.1 => 3.1.0 (upgrade probably handled by requests)
coverage==6.4.4 => 7.2.3 (? - code coverage should be looked at separately)
cryptography==38.0.1 => 40.0.1 (drops support for older OpenSSL and OSes)
datetime==4.7 => 5.1 (dropped older Python support)
django-crispy-forms==1.14.0 => 2.0 (Required some config changes. Could potentially cause UI issues with HTML in forms.)
django-filter==22.1 => 23.1 (no breaking changes)
edx-auth-backends==3.4.0 => 4.1.0 (JWT changes should be encapsulated to libraries)
edx-drf-extensions==6.6.0 => 8.5.3 (JWT changes should be encapsulated to libraries)
faker==14.2.0 => 18.4.0 (seems ok)
fixtures==3.0.0 => 4.0.1 (Dropped old Python support)
google-api-core==1.30.0 => 2.11.0 (Dropped old Python support)
google-auth==1.32.1 => 2.17.2 (Dropped old Python support)
multidict==5.1.0 => 6.0.4 (Dropped old Python support)
packaging==21.3 => 23.0 (Hoping this is ok; not sure what we package)
paramiko==2.11. => 3.1.0 (Should be ok, assuming other libraries have made fixes)
platformdirs==2.5.2 => 3.2.0 (Hopefully all works)
protobuf==3.17.3 => 4.22.1 (Hopefully all works)
pyjwt[crypto]==1.7.1 => 2.6.0 (JWT changes should be encapsulated to libraries)
pyopenssl==22.0.0 => 23.1.1 (No incompatible changes)
pyrsistent==0.18.1 => 0.19.3 (No incompatible changes)
pytz==2016.10 => 2023.3 (Seems ok)
requests-toolbelt==0.9.1 => 0.10.1 (No incompatible changes)
social-auth-app-django==4.0.0 => 5.2.0 (Drop old Python support)
stevedore==4.0.0 => 5.0.0 (Unknown, but should be ok)
stripe==4.1.0 => 5.4.0 (Dropped old Python; Excception typo fixes that don't affect us)
wheel==0.37.1 => 0.40.0 (Drop old Python support)
zope-interface==5.4.0 => 6.0 (Drop old Python support; other changes hopefully handled by dependencies)

[robrap]

Note to Reviewer: At this time, the only failing tests are codecov, which I plan to ignore since the data seems to be outdated.

[zubair-ce07]

LGTM !