Bump go-jose to a newer version

[raskchanky]

Description

We'd like to update go-jose to a newer version. It's currently in a few places:

• root go.mod
• sdk go.mod

There will be a separate PR to address its presence in an ENT only go.mod.

The sdk go.mod only included the old version due to its dependency on the API package, which updated go-jose some time ago. Updating that was just a matter of go get -u and go mod tidy. Updating it in the root go.mod is trickier because it's being included there indirectly via the Okta SDK, which has changed a bit since v2 (they're currently up to v5).

TODO only if you're a HashiCorp employee

• Labels: If this PR is the CE portion of an ENT change, and that ENT change is
  getting backported to N-2, use the new style backport/ent/x.x.x+ent labels
  instead of the old style backport/x.x.x labels.
• Labels: If this PR is a CE only change, it can only be backported to N, so use
  the normal backport/x.x.x label (there should be only 1).
• ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signature
  of a public function, even if that change is in a CE file, double check that
  applying the patch for this PR to the ENT repo and running tests doesn't
  break any tests. Sometimes ENT only tests rely on public functions in CE
  files.
• Jira: If this change has an associated Jira, it's referenced either
  in the PR description, commit message, or branch name.
• RFC: If this change has an associated RFC, please link it in the description.
• ENT PR: If this change has an associated ENT PR, please link it in the
  description. Also, make sure the changelog is in this PR, not in your ENT PR.

[github-actions]

CI Results: failed ❌