GHSA-4fjv-pmhg-3rfg

### Impact * Client implementations using this library ### Issues 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) `oic.consumer.Consumer.parse_authz` returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) `iat` claim was not checked for sanity (i.e. it could be in the future) ### Patches 1) IdToken signature is now always checked. 2) JWA `none` algorithm is now allowed only if using the `response_type` `code` 3) IdToken verification is now done automatically. 4) `iat` claim is now checked for sanity.