Adding /well-known endpoint to fetch JWKs

[HatemMn]

Overview

The KMS is not a JWT issuer

This table clarifies the actual use cases for this PR

Who fetches /.well-known/jwks.json ?	Why ???	Is KMS the token issuer?
A service that received a JWT signed by the KMS (via KMIP Sign)	Needs the public key to verify the signature	No — the caller signed the token using KMS as an oracle
Another KACLS instance during a /rewrap migration	Verifies the peer-authentication JWT that KMS signed internally	No — internal KMS-to-KMS trust, not user-facing tokens
An OIDC relying party expecting KMS to be an IdP	Would fetch JWKS to verify ID tokens	❌ Wrong use case — KMS is not an IdP and issues no ID tokens