Make acceptable JWT types configurable

With KNOX-2149, one can define their own JWKS URL which Knox can use for verification.

However, the current implementation only supports JWTs with "typ: JWT" in their headers (or not type definition at all). In previous JOSE versions, there were other supported types such as at+jwt.

It'd be beneficial to have the list of allowed JWT types defined on the topology level. If not defined, Knox should use the current default (JWT).