Tests for handling duplicated / conflicting JWKs.

These cases are unlikely to happen in practice, as oauth providers will
almost certainly remain well-behaved. Nevertheless, we want to continue
behaving correctly even with pathological inputs.