Ensure that JWT iss fields match kid fields

[flhps]

This could be a default check or configurable in the policy.

E.g.: if the kid is a pubkey and the iss is a did:pkh, we need to ensure they match