Add more keycache APIs

[bbockelm]

1. The keycache API has the ability to "refresh" the issuer (forcing an update, regardless of whether it's needed); there's also "get" that retrieves the current state in the database. However, there's no easy way to query an issuer and only trigger a refresh if needed ("load"?).
2. There's no API for metadata (you can get the JWKS contents but not the expiration time or next_update).
3. There's no API for deleting a keycache entry.

Add these APIs; for the metadata API, allow arbitrary extra information to be included as a JSON string output (currently empty is OK).

Make sure to include unit (or, as necessary, integration) tests showing the functionality works as desired.