Update: [JWT] Additional threats

What is missing or needs to be updated?

After cleanup PR #2283, the content would have to be fleshed out.

How should this be resolved?

Add something about the threats:

• key type confusion (→ added in #2283);
• issuer confusion;
• audience confusion;
• token type (cross-JWT) confusion;
• blindly trusting/following the jwk, jku, x5u, x5t, x5t#S256 header parameters.

Check:

• RFC88725
• RFC88725 bis (draft)