Validate JWK for HmacSecretKey Class about webcrypto.dart

[jonasfj]

This probably doesn't just apply to HmacSecretKey, but all places where we do importJsonWebKey.

I think on the web window.crypto.subtle.importKey always requires that you explicitly specify:

• (a) the key (format and keyData)
• (b) what kind of key you want to import (algorithm parameter, like HmacImportParams).
• (c) what the key may be used for (extractable and keyUsages).

We've largely opted not to do (c), see discussion in #53.

But yes, in some cases parts of (b) could be omitted. In particular when talking about JWKs.

I guess the benefit of reading the hash from the JWK, is that it's easier to just download a JWK from somewhere and use it. Where as, the way the API currently looks you have to read the alg property of the JWKand switch onHS1, HS256, etc, to pass instances of Hash.sha1orHash.sha256in thehash` parameter. This isn't super convenient.

On the other hand, if you download a JWK from somewhere without checking to see what hash it's using, you might unintentionally be using a weaker hash than you intended. And on most use cases you probably know what kind of algorithm you expect to be using, and you shouldn't want your code to dynamically use a different hash.

So perhaps it's best to say that you can import a JWK, but you must specify what you expect the JWK to be.

And if you want to support importing any kind if JWK, then it's in convenient, and you'll have read the JWK alg, etc...

I'm actually leaning towards the current API, just because we don't necessarily want this package to provide something that is possibly too smart. And maybe it's better to be simple and a little inconvenient. And if someone really wants a smart crypto library that an import any JWK by just parsing the JWK, then maybe that someone should make a high-level package with a high-level API for this purpose.

[jonasfj]

As such maybe the only take away from this is:

• Let's delete the TODO comments 🤣
• Let's always make sure that whenever a JWK has a property, the value of said property is consistent what how we intend to use it.
  (This might especially make sense since most JWKs have lots of optional properties).

But I'm also interested in hearing other perspectives.