TUN-10801: Cache quick tunnel broker JWKS

## Summary

Adds the process-local broker JWKS cache used by protected Quick Tunnel assertion validation. Fetches keys only from the fixed broker endpoint with a five-second timeout, refuses redirects, bounds and validates responses, accepts only public P-256 ES256 signing keys, reuses cached keys, and refreshes once for an unknown key ID. Concurrent cache misses and refreshes are deduplicated.

## Stack

- Part 1/2: this MR
- Followed by: `afrigerio/TUN-10801-assertion-validation`

## Validation

- `make test lint`
- focused `go test -race ./connection` coverage for JWKS caching and refresh