Bump go-oidc

[aeijdenberg]

Description

Latest go-oidc contains coreos/go-oidc@20c0c22 which ensures that the SupportedSigningAlgs is never empty.

Motivation and Context

If -skip-oidc-discovery / OAUTH2_SKIP_OIDC_DISCOVERY / skip_oidc_discovery is set, then this codepath will create a verifier with no signature algorithms set. With previous versions of go-oidc, that would skip checking if the alg is in a whitelist, which may allow the infamous none algorithm be evaluated.

How Has This Been Tested?

I haven't tried to exploit this, it just stood out while reviewing this code for common errors - and given that generally during an authorization_code flow the token is fetched directly from the IdP, rather than accepted from users via a header (and due to other reasons listed in the go-oidc commit), it may not easily be exploitable, but still should be fixed, since it's easy.

Checklist:

• My change requires a change to the documentation or CHANGELOG.
• I have updated the documentation/CHANGELOG accordingly.
• I have created a feature (non-master) branch for my PR.

[JoelSpeed]

Hey, good spot, seems like a reasonable change

Since this fix is in the v2.0.0 release, perhaps it would be better to add an override to the Gopkg.toml and then pin to a release? WDYT?

Could you add a CHANGELOG entry to include the updated version, I feel this is important enough to note in the changelog

[JoelSpeed]

LGTM