JWT tokens issues by Knox should have `kid` and `jku` as part of JOSE Headers

Currently we have `kid` and `jku` claims as part of JWT token body. It should also be part of JOSE Headers. This is part of JWT specs https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.4