* PyJWS._verify_signature: raise early KeyError if header is missing alg

* Make Mypy configuration stricter

* Improve typing in jwt.utils

* Improve typing in jwt.help

* Improve typing in jwt.exceptions

* Improve typing in jwt.api_jwk

* Improve typing in jwt.api_jws

* Improve typing & clean up imports in jwt.algorithms

* Correct JWS.decode rettype to any (payload could be something else)

* Update typing in api_jwt

* Improve typing in jwks_client

* Improve typing in docs/conf.py

* Fix (benign) mistyping in test_advisory

* Fix misc type complaints in tests

* allow configuration of custom headers in JWKClient

* revert changes to algorithms

* document example usage of custom headers

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* black format tests

* Add a release note for optional headers arg

Co-authored-by: thundercat1 <michael.haines@recursionpharma.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

* Add compute_hash_digest to Algorithm objects

`Algorithm.compute_hash_digest` is defined as a method which inspects
the object to see that it has the requisite attributes, `hash_alg`.

If `hash_alg` is not set, then the method raises a
NotImplementedError. This applies to classes like NoneAlgorithm.

If `hash_alg` is set, then it is checked for
```
has_crypto  # is cryptography available?
and isinstance(hash_alg, type)
and issubclass(hash_alg, hashes.HashAlgorithm)
```
to see which API for computing a digest is appropriate --
`hashlib` vs `cryptography.hazmat.primitives.hashes`.

These checks could be avoided at runtime if it were necessary to
optimize further (e.g. attach compute_hash_digest methods to classes
with a class decorator) but this is not clearly a worthwhile
optimization. Such perf tuning is intentionally omitted for now.

* Add doc example of OIDC login flow

The goal of this doc example is to demonstrate usage of
`get_algorithm_by_name` and `compute_hash_digest` for the purpose of
`at_hash` validation. It is not meant to be a "guaranteed correct" and
spec-compliant example.

closes #314

* fix(api_jwt): update audience typing & type checking

* doc(api): update decode.audience typing

* feat(test_api_jwt): ensure audience as bytes raises error

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* refacto(api_jwt): precise typing

Co-authored-by: Julian Maurin <julian.maurin.perso@pm.me>

Update jwt/api_jwt.py

Co-authored-by: Julian Maurin <julian.maurin.perso@pm.me>

fix(jwt/api_jwt.py): backport future annotations

* fix: handle audience=0

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Asif Saif Uddin <auvipy@gmail.com>

* Fix for headers disorder issue

Related issue #715

* Added comment with reference to issue

 Needed to trigger tests once more time.

* Fix for hardcoded value in docs after adding sort to jwt/api_jws.py

* Removed unneeded comment - issue #721

In the example above [https://github.com/jpadilla/pyjwt/edit/master/docs/usage.rst#encoding--decoding-tokens-with-hs256], when tried, it throws a TypeError that says: `encode() got an unexpected keyword argument 'algorithms'`, so I changed the `algorithms` to `algorithm`

* Mention reusing RSAPrivateKey for performance reasons

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Fix: #458

Co-authored-by: Stefan Seering <sseering@todo.find.proper.mail.domain>