Bump jose to v5 about node-jwks-rsa

[ssipos90]

agreed, seeing as JOSE 4.15 is now flagged by audit:

$ npm audit
# npm audit report

jose  3.0.0 - 4.15.4
Severity: moderate
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - https://github.com/advisories/GHSA-hhhv-q57g-882q
fix available via `npm audit fix`
node_modules/jwks-rsa/node_modules/jose

[panva]

I believe jose v4 is no longer supported

It clearly is https://github.com/panva/jose#supported-versions

agreed, seeing as JOSE 4.15 is now flagged by audit:

4.15.5 and 2.0.7 was released as per the Supported Versions matrix to fix the vulnerability in those release lines.

jose to v5

not necessary, all you need to do is to run whatever equivalent of npm upgrade in your package manager is, 4.15.5 will be installed and there's no longer an issue.

[blindperson]

Hi team, do we have any plan to ship in this pr?
#405