Replace github.com/dgrijalva/jwt-go with something without open CVEs

[zepatrik]

This https://nvd.nist.gov/vuln/detail/CVE-2020-26160 is not fixed since over a year now, as the library seems abandoned. We can either use a fixed fork of it (e.g. github.com/form3tech-oss/jwt-go) or look for something different that is actually maintained.
This shows up in nancy recently, see e.g. https://app.circleci.com/pipelines/github/ory/keto/1112/workflows/e646084f-2afa-455f-8437-445d1dac190a/jobs/7654

[aeneasr]

Yes we should move to github.com/form3tech-oss/jwt-go . All we have to do really is to replace the dependency.