Implement private_key_jwks client authentication

This involves a lot of things, including:
 - better VerifyingKeystore trait
 - better errors in the JOSE crate
 - getting rid of async_trait in some JOSE traits

crates/http/src/layers/json.rs

@@ -53,6 +53,7 @@ impl<S, B> Error<S, B> {
     }
 }
 
+#[derive(Clone)]
 pub struct Json<S, T> {
     inner: S,
     _t: PhantomData<T>,