Switch to manual JWT verification of ID token from IdP

[alyssadai]

• Related to: Switch to manual JWT verification of ID token from IdP federation-api#138

Even for a trial implementation, we can no longer rely on Google as our IdP because we have discovered that the "testing" mode of our Google service API does not restrict login to the app (namely, access to the basic user info provided by default in the ID token) based on test user list as originally expected. See https://issuetracker.google.com/issues/211370835#comment68 for more info on this behaviour.

So, to be able to employ any kind of "user list" to restrict queries for now, we need to use a different IdP and more generic ID token verification method.

• use PyJWT library (update requirements.txt)
• obtain certificate URL for Google to send a request for public keys (fetched automatically with google_auth package)
• decode and validate claims of JWT manually
• remove google_auth from dependencies?

[neurobagel-bot]

🚀 Issue was released in v0.4.3 🚀