[Server] Fix JwtTokenValidator fetching keys only for the first issuer

[chr-hertel]

Closes #530

• read the unverified iss from the payload first and reject it unless it's one of the configured issuers - before any discovery or JWKS fetch
• fetch the keys for that issuer, then verify signature & claims as before
• an explicit jwksUri applies to all listed issuers, which fits the alias semantics and keeps the Keycloak & Microsoft examples working
• docs now say the issuer list is meant for aliases of one authorization server