GHSA-4fjv-pmhg-3rfg Multiple cryptographic issues in Python oic

• PyPI oic: < 1.2.1 → fixed in 1.2.1

Impact • Client implementations using this library Issues 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) `oic.consumer.Consumer.parse_authz` returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) `iat` claim was not checked for sanity (i.e. it could be in the future) Patches 1) IdToken signature is now always checked. 2) JWA `none` algorithm is now allowed only if using the `response_type` `code` 3) IdToken verification is now done automatically. 4) `iat` claim is now checked for sanity.