fix: allow TLSv1.3 for remote JWKS fetching

[michaelbeaumont]

What this PR does / why we need it:

If the JWKS endpoint is https, currently it won't offer/allow TLS v1.3 and fails if that's the only version available.

---

PR Checklist

• Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
• DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
• API agreed first: If this PR contains API changes (changes under /api), the API was discussed and agreed before the implementation. The API change can be in a separate PR, or in the same PR, but the API must be agreed before implementation. N/A if this PR does not contain API changes.
• Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.)
• Tests added/updated: New/changed code is covered by appropriate tests. N/A if this PR does not contain code changes.
• Docs: User-facing changes update the docs, either in this PR or a follow-up PR. N/A if this PR does not contain user-facing changes.
• Release notes: For any non-trivial change, added a release-note fragment under release-notes/current/<section>/<pr-number>-<slug>.md (see release-notes/current/README.md for sections and naming). N/A if this PR does not contain non-trivial changes.
• Generated files committed: Ran make gen-check and committed the result if API/helm charts/modules changed.
• Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/.
• Codex review: Requested a Codex review and addressed all of its comments.
• Copilot review: Requested a Copilot review and addressed all of its comments.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	93026ca
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a6342fa3ffa70000842a67e
😎 Deploy Preview	https://deploy-preview-9531--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d4832b4a2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.61%. Comparing base (55ae848) to head (93026ca).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9531      +/-   ##
==========================================
+ Coverage   75.60%   75.61%   +0.01%     
==========================================
  Files         252      252              
  Lines       41758    41761       +3     
==========================================
+ Hits        31571    31578       +7     
+ Misses       8059     8057       -2     
+ Partials     2128     2126       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jukie]

Please sign your commits and add a release note