Make JWKSettings signingKey optional

[jmaness]

For integration with external auth provider (e.g. Okta, Auth0, AWS Cognito) where JWTs only need to be verified and never signed, it would be useful if the signingKey field of JWKSettings was optional (e.g. Maybe Jose.JWK). For now, it seems like a workaround is to populate it with a dummy key.

[b4er]

The HasServer instance is flawed and that is not possible at the moment (depends on #1560). The router always creates a new (signed) session cookie when auth succeeds (ref).

For now you're stuck writing your own HasServer instance. Using cookie-auth without JWT or JWT without cookie auth is simply impossible as of now.