[VI-252] MAP STS token validation

[bramleyjl]

Summary

• Updates the MAP token request logic to include validation of the returned token.
• The MAP public jwks are requested and stored through the SIS PublicJwks & cached in Redis for 30 minutes, Redis key is map_public_jwks.
• Tokens that fail validation will cause a JWT:DecodeError that is logged and re-raised at the MAP service level and returns a 502 bad gateway error at the MAP controller level.
• The mocked JWKs used are VA.gov-created and used to sign the mocked MAP token response in order to have the token bypass expiry validation - the mocked MAP token is set to expire in 2036.

Related issue(s)

• mockdata PR: https://github.com/department-of-veterans-affairs/vets-api-mockdata/pull/569

Testing done

• New code is covered by unit tests
• Make sure your vets-api-mockdata is active and is on the latest of master to include the mockdata changes linked above.
• Make a MAP token request
  • the request should be successful & return a JSON body with an access_token
  • you should see the following log immediately after the MAP token request log: [MAP][SecurityToken][Service] Get Public JWKs Success
• Update the access_token in the body of the mockdata file at vets-api-mockdata/map/secure_token_service/token.yml to change the token response (your vets-api instance should now be maintaining the JWK if you don't restart it) & make the MAP token request again
  • The request should fail with a 502 bad gateway error
  • you should see [MAP][SecurityToken][Service] token failed, JWT decode error -- { :application => :chatbot, :icn => <icn>, :context => "Signature verification failed" } in your Rails logs

What areas of the site does it impact?

MAP STS token requests

Acceptance criteria

• I fixed|updated|added unit tests and integration tests for each feature (if applicable).
• No error nor warning in the console.
• Events are being sent to the appropriate logging solution
• Documentation has been updated (link to documentation)
• No sensitive information (i.e. PII/credentials/internal URLs/etc.) is captured in logging, hardcoded, or specs
• Feature/bug has a monitor built into Datadog
  • MAP Datadog Dashboard already tracks MAP service errors & will pick up JWT::DecodeError.
• If app impacted requires authentication, did you login to a local build and verify all authenticated routes work as expected

[bosawt]

Confirmed staging and production routes are reachable