kid vs sub for signature validation

[p15r]

Currently, a kid-to-cert map is used to determine which cert is required to verify a JWT signature. However, the kid is optional and not part of rfc7519. It is, however, part of rfc7515 (https://tools.ietf.org/html/rfc7515#section-4.1.4). Therefore, it might be better to create a issuer->subject->cert map (especially if a key consumer, other than Salesforce, does not provide a kid in the JWT protected header).