Cache only the LTI 1.3 signing key actually needed from the LMS public keyset. (Hotfix of #3190)

[drgrice1]

Only one key is ever actually needed to verify a given incoming JWT. Fetch the full keyset from the LMS when there's no cached key or the currently cached key does not work (presumably because it has expired), but don't cache it yet. Once the JWT has been decoded, pull the key from the keyset that is actually used to decode that JWT, and in the case that the keyset was just retrieved from the LMS, then cache just that one key.

D2L Brightspace can serve a large number of keys in its keyset. It most likely uses a different public/private key for each external tool, and it seems that some D2L instances are even shared by multiple institutions in which case each institution has its own set of public/private keys in the keyset. When there are enough keys in the keyset its size can exceed the 64KB limit of the TEXT value field in the settings table. So caching only the needed key keeps that from happening.

This should fix issue #3189. This was also reported in https://forums.openwebwork.org/mod/forum/discuss.php?d=8834 (although I suspect those are really the same D2L instance as in the issue) and https://forums.openwebwork.org/mod/forum/discuss.php?d=8832.

[dlglin]

This works on our test D2L instance. Before this PR all keys from the keyset URL are stored to the WW DB. After the PR only one key is stored.
Note that checking out this PR didn't change the keys that were stored for any WW courses that were already linked to D2L, but that shouldn't be a problem. I was still able to log in to those courses, and anyone who ran into the "Data too long" error wouldn't have an entry saved to the DB.

[drgrice1]

Yeah, if there is already a valid keyset in the database it will be used. The format of what is stored is the same, just one kid instead of all of them.