fix(HNT-3493): upgrade jwks-rsa to 3.2.2 to drop vulnerable axios

[mmiermans]

Goal

Remove axios@0.21.4 (and its advisories) from admin-api's JWKS path by upgrading jwks-rsa 1.12.3 → 3.2.2.

• getSigningKeyAsync → promise-based getSigningKey (the 2.x+ API)
• npm audit fix for transitive advisories, including jws 3.2.3 (HMAC verification fix on the JWT path)
• Production advisories: 42 → 21 (critical 3 → 1, high 22 → 10)

Implementation Decisions

• 3.2.2 rather than 4.x: 4.x requires Node ≥20.19, and admin-api runs Node 18 (specs run on Node 16 in CircleCI). 3.x already drops axios. Node moves to 24 later in this stack (HNT-3495).
• The existing nock-backed getSigningKeysFromServer test covers the change.
• Supersedes fix(deps): [INFRA-1371] Upgrade jwks-rsa package and update deprecated code #354.

Deployment steps

• Confirm admin-api accepts curation tools and lambda JWTs after deploy

References

JIRA ticket:

• HNT-3493 (part of HNT-1771)