Add JWT validation

[ahsimb]

Here is the finding of the ITM team and suggested remedy:

JWT algorithm & header hardening fully delegated to FastMCP (most relevant for impersonation)

• We correctly rely on FastMCP for JWT verification (no custom parsing logic here 👍), but:
  • We don’t enforce a local allow-list for EXA_AUTH_ALGORITHM.
  • We don’t explicitly reject none or any other forbidden / unexpected algorithms.
• If FastMCP ever introduced a bug or relaxed something around algorithms, we would inherit that risk immediately because we don’t add an extra guard layer on our side.

Suggested follow-ups:

• Add a small local validation step around EXA_AUTH_ALGORITHM:
  • Only allow a set of strong algorithms (e.g. RS256/384/512, ES256/384/512, PS256/384/512, optionally HS256/384/512 for internal-only).
  • Explicitly reject none and anything not in the list.
• Document the recommended algorithms and auth setup in our user guide so deployments are steered toward a hardened default.

UPDATE:
To implement the proposed change, we would have to do one of the following:

• require an explicit value - do not use the FastMCP default.
• read the value back from the created JWTVerifier object - use undocumented attribute.
• use our own default value - take the responsibility of selecting the most appropriate algorithm.

None of these options is ideal.