replace go-jose.v2 with newer version because it is vulnerable to CVE-2024-28180

[gunturaf]

Based on the advisory in this link, the go-jose.v2 is vulnerable:
GHSA-c5q2-7r4c-mv6g

I tried to fix in my local clone of krakend-jose, but it seems that the underlying dependency of go-auth0 also needs to be updated.

I might be able to send MRs for both of the repositories affected, but in this issue I just want to let you folks know that this vuln might be blocking some organizations that uses trivy in their CI/CD pipeline.

[alombarte]

Thanks @gunturaf. Generally speaking, trivy is an excellent tool but it also gives a lot of false positives, so blocking your pipelines because of it IMHO is a drastic measure and not an advisable strategy.

That being said, KrakenD does not support JWE, and while this vulnerability is on the JOSE package, it does not affect KrakenD. Feel free to open MR for review, but I must warn you that the go-auth0 will be "challenging".