[SDK-3863] Add support for Client Assertion in authentication endpoints

[stevehobbsdev]

Changes

This PR adds support for specifying an asymmetric key for the purposes of signing a client assertion JWT to authenticate with Auth0, as an alternative to client_secret. See Private Key Jwt.

With these changes, the SDK accepts two new arguments on client creation:

• client_assertion_signing_key: A key used for signing the client assertion JWT (the corresponding public key should be uploaded to your Auth0 tenant)
• client_assertion_signing_alg: The signing algorithm to use (defaults to RS256 if not specified

The client_secret argument can then be omitted. If both client_secret and client_assertion_signing_key are specified, the latter takes precedence.

The key can be anything accepted by ruby-jwt.

key_string = File.read 'key.pem'
key = OpenSSL::PKey::RSA.new key_string

client = Auth0Client.new(
  domain: 'AUTH0_DOMAIN',
  client_id: 'AUTH0_CLIENT_ID',
  client_assertion_signing_key: key)

Testing

Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of Ruby

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors
• Rubocop passes on all added/modified files
• All active GitHub checks have passed

[stevehobbsdev]

CodeCov is failing but is also reporting no changes in the diff 🤷🏻

[adamjmcgrath]

lgtm