Move away from github.com/dgrijalva/jwt-go as JWT library

[jannfis]

Summary

The github.com/dgrijalva/jwt-go seems to be abandoned and not maintained any more, but contains a security vulnerability marked as high. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26160

The remediation says to update to 4.0.0-preview1, but from our research, this version does not contain any fix for the specified issue.

There is a fork at github.com/form3tech-oss/jwt-go which includes a correct fix. This seems to be the only code change so far: dgrijalva/jwt-go@master...form3tech-oss:master

Motivation

Provide a secure JWT implementation within Argo CD.

Proposal

• Move temporarily to a fork of github.com/dgrijalva/jwt-go that provides a correct fix for the issue
• Evaluate migration to another JWT library, that is better maintained (or, maintained at all)
• If decision has been made to migrate to another library, refactor our code to make use of it

[jannfis]

OK, so the research was probably wrong. The fix is in another branch - release_4_0_0 - not in master. So we can upgrade to 4.0.0-preview1 instead of to the fork. Also, my initial tests showed that the fork doesn't handle single aud claims in tokens, only two or more.

[jannfis]

The successor to this is apparently https://github.com/golang-jwt/jwt, according to dgrijalva/jwt-go#462 and the update of the README in jwt-go repository.

[alexmt]

@jannfis we can close this, right?

[jannfis]

Oh nice. I forgot about this one totally :)

Closing. Was implemented by #8136