Fix code scanning alert no. 1: Server-side request forgery

[stepchud]

Fixes https://github.com/GSA/Challenge_platform/security/code-scanning/1

To fix the problem, we need to validate the jwks_uri before using it in the HTTP request. One way to do this is to ensure that the jwks_uri is within a specific domain or matches a specific pattern. This can be done by checking the hostname of the jwks_uri against a whitelist of allowed hostnames or by using a regular expression to validate the URL format.

We will add a method to validate the jwks_uri and call this method before making the HTTP request. If the jwks_uri is not valid, we will raise an error.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.