feat: validate aud payload

feat: add source config of the JWT bearer/header/cookie/query

The config field is called JwtSources,
the format is [{type: ...., key: ...},]
Possible types are bearer, header, cookie, query.
The order of the list enty is the order in wich the JWT wil be tried to
retrieved.

fix: added support for JSON bodies of type array and literals (Fixes #54

)

fix: cancel BackgroundRefresh on config reload

This commit mitigates a thread leak that occurs when a config
instantiating the plugin is reloaded. The plugin's `BackgroundRefresh`
goroutine will now be canceled when the plugin is instantiated with the
same name, which should only occur when the config is reloaded.
Closes #67

feat: allow refreshing keys once via jwks URL when current jwt kid is…

… not found

fix: readme

chore: release

feat: add configurable header opts for JWKS request

fix: ignore authorization header prefix capitalization

chore: add missing test for JwtCookieKey