fix: add timeouts for JWKS HTTPS requests and share key registry across Traefik routes

[groot314]

Fixes #86

Problem

As described in #86, ForceRefreshKeys can block requests forever: the request goroutine waits on an unbounded channel handshake with the refresh goroutine, and JWKS fetches use a default http.Client with no timeout, so a hanging JWKS endpoint stalls requests indefinitely.

There is a second related failure mode: Traefik constructs a separate plugin instance per router chain referencing the middleware, and rebuilds them all on every dynamic configuration reload. The current code cancels "the previous" background refresh goroutine by plugin name, which kills the refresher of a sibling instance that is still serving — freezing its cached JWKS keys.

Changes

• HTTPS timeouts: new JwksFetchTimeoutSecs config option bounds each JWKS request, and (with ForceRefreshKeys) bounds how long a request waits for a forced refresh before continuing with the currently cached keys. Defaults to 0 (no timeout) to preserve existing behavior.
• Shared key registry: key material and the background refresh goroutine now live in a keyRegistry shared by every plugin instance built from the same configuration (keyed on plugin name + keys + JWKS headers + timeout), so one refresh goroutine serves all routes and config reloads no longer orphan live instances.
• Tests updated/added for the new behavior.