refactor: drop old golang-jwt/jwt dependency

[kruskall]

Proposed commit message

drop old golang-jwt/jwt dependency

We are only using a small method that has nothing to do with jwt, it's better to copy the method and drop the dependency.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @kruskall? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

[shmsr]

Although the changes look good, I suggest that since we have github.com/golang-jwt/jwt/v4 as an indirect dependency, why not use the function from there as the code is essentially the same and there is no overhead as far as I know. It is just that github.com/golang-jwt/jwt/v4 becomes a direct dependency.

[kruskall]

I disagree. Direct and indirect dependencies are not the same and should not be treated the same.
Beats already disables dead code elimination due to problematic use of reflection, adding more direct dependencies only makes the problem worse by increasing binary size for downstream users.

[shmsr]

But it is included, right? Indirect are dependencies imported by direct dependencies. So, they are already on the build list. As github.com/golang-jwt/jwt/v4 is already in the build list, I suggested let we make it a direct dependency instead (not v5, but v4).

What do you think?

[kruskall]

After #39968 the jwt lib is actually used (which is good because it got rid of another dep) so this PR is not needed anymore.

[shmsr]

After #39968 the jwt lib is actually used (which is good because it got rid of another dep) so this PR is not needed anymore.

Also, as per my discussion with Craig offline, we decided to go with github.com/golang-jwt/jwt/v5 v5.0.0 for the fork used in #39840. See: elastic/go-sfdc@bcc8456

So, dropped one more extra lib (indirectly): github.com/dgrijalva/jwt-go (that too deprecated)