fix: widen verify_broker_token except clause to jwt.PyJWTError

[kratsg]

Summary

verify_broker_token in src/krb5_token_service/identity.py catches
jwt.InvalidTokenError (and ValueError/KeyError) around the JWKS-based
signature verification, but jwt.algorithms.RSAAlgorithm.from_jwk(key_data)
(called just above, to build the public key from a JWKS entry) can raise
jwt.exceptions.InvalidKeyError for a malformed or non-RSA JWKS entry --
e.g. reachable via _select_jwk's single-key fallback path whenever the
JWKS happens to publish exactly one key and that key is malformed/non-RSA.

InvalidKeyError is a jwt.PyJWTError subclass but not a subclass of
InvalidTokenError, and isn't ValueError/KeyError either, so it escaped
both except clauses and propagated out of verify_broker_token entirely
uncaught -- surfacing as a bare unhandled 500 with no audit log line at
all (the route handler's except HTTPException never sees it). A broker
JWKS key-rotation glitch or misconfiguration (a non-RSA key appearing in
the published JWKS) would silently produce unaudited 500s instead of the
usual audited 401.

Fix

Widen the first except clause from jwt.InvalidTokenError to
jwt.PyJWTError -- the common base class for both InvalidTokenError and
InvalidKeyError -- so any PyJWT-raised verification failure is classified
as a normal, audited 401.

This was found and first fixed in servicex-token-service during code
review while building that service (identity.py is shared, near-verbatim,
across the voms/krb5/condor/servicex-token-service family). This PR ports
the same fix here since krb5-token-service's identity.py has the exact
same bug.

Test plan

• Added test_malformed_jwks_key_is_401 in tests/test_identity.py:
  builds a JWKS entry missing n/e ({"kid": "malformed-key", "kty": "RSA", "use": "sig"}), mints a token whose kid matches it, and asserts
  verify_broker_token raises HTTPException with status_code == 401.
  Reassigns stub_jwks_fetch.keys to a new list rather than mutating in
  place, since the underlying jwks fixture is session-scoped.
• Confirmed the new test fails against pre-fix code (raises unhandled
  jwt.exceptions.InvalidKeyError instead of HTTPException).
• Confirmed the new test passes against the fix.
• pixi run -e dev check (lint + format + mypy + full test suite):
  148 passed, 1 skipped, no regressions.

Generated with Claude Code