Fixes #33055: Support ADFS-style JWTs

This uses the keyfinder method support from the JWT gem to look for keys
in both the standard 'kid' header as well as the non-standard 'x5t' one.