Migrate spring-security-jwt to Nimbus JOSE+JWT

org.springframework.security.jwt shipped with Spring Security OAuth and is no longer maintained. Spring Security uses Nimbus JOSE+JWT for its own JWT support, which is what replaces it. This recipe adds the nimbus-jose-jwt dependency to a module that uses the retired API and annotates every use of it with the Nimbus call that replaces it. It deliberately rewrites no code, because this API cannot be migrated one call at a time. Three things stop it. The Nimbus calls throw checked exceptions that the Spring ones did not, so a rewritten call site does not compile until its method declares ParseException and JOSEException or catches them. Jwt.getClaims() returns the claims as a String where SignedJWT.getJWTClaimsSet() returns a JWTClaimsSet, so the result is not substitutable. And a Spring Signer and a Nimbus JWSSigner share no supertype, so changing a signer's constructor leaves every declaration and call that consumes it mismatched. The comments say what each call becomes and what it needs, so the remaining work is mechanical but deliberate. Run on its own this recipe leaves a compiling build, since the spring-security-jwt dependency is still there. Run as part of MigrateSpringSecurityOAuth, that dependency is removed, so each marked call stops compiling and the instruction for fixing it is on the line above. The signature checks are called out separately, because JwtHelper.decodeAndVerify and Jwt.verifySignature threw on a bad signature while the Nimbus verify returns a boolean, and a rewrite that drops that result leaves code which parses a token and never checks it.