What kind of change does this PR introduce?

This is a feature implementation that adds a configurable fallback for OIDC ID token verification when the token's kid header does not match any key in the provider's JWKS.

What is the current behavior?

When jwt.decode() raises InvalidKeyIdError, the code refreshes the JWKS and retries. If the kid still does not match after refresh, InvalidKeyIdError is raised with no way to recover. This breaks integration with OIDC providers whose JWKS keys lack a kid field or use kid values that do not match the token header.

What is the new behavior?

On InvalidKeyIdError:

1. Refresh JWKS via fetch_jwk_set(force=True) to handle key rotation
2. Retry kid-based decode with refreshed keyset
3. If should_try_all_keys() returns True, try each key individually; otherwise re-raise InvalidKeyIdError (default, backwards-compatible)

Subclasses can override should_try_all_keys() to enable the brute-force fallback:

class MyOAuth(OAuth):
    def should_try_all_keys(self):
        return True

Checklist

• The commits follow the conventional commits specification.
• You ran the linters with prek.
• You wrote unit test to demonstrate the bug you are fixing, or to stress the feature you are bringing.
• You reached 100% of code coverage on the code you edited, without abusive use of pragma: no cover
• If this PR is about a new feature, or a behavior change, you have updated the documentation accordingly.

• You consent that the copyright of your pull request source code belongs to Authlib's author.