fix(jwt): deny requests that have different tokens in the jwt token search locations.

[vm-001]

Summary

Deny requests that have different tokens in the jwt token search locations.

Checklist

• The Pull Request has tests
• There's an entry in the CHANGELOG
• There is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HERE

Issue reference

FTI-4580

[dndx]

The general approach of this PR is fine. However, I see no good reason of returning a Lua table from retrieve_tokens just for duplicate detection. Maybe the retrieve_tokens function can simply return nil, "Multiple tokens provided" in case more than one unique token is present in the same request. This way we avoid two table allocations and use of pairs which could be expensive.

[vm-001]

The general approach of this PR is fine. However, I see no good reason of returning a Lua table from retrieve_tokens just for duplicate detection. Maybe the retrieve_tokens function can simply return nil, "Multiple tokens provided" in case more than one unique token is present in the same request. This way we avoid two table allocations and use of pairs which could be expensive.

I've thought about this approach(And yes, this is a better way for performance). If retrieve_tokens returns nil, "Multiple tokens provided", it will run into. https://github.com/Kong/kong/blob/master/kong/plugins/jwt/handler.lua#L122. Instead of leveraging this predefined branch(https://github.com/Kong/kong/blob/master/kong/plugins/jwt/handler.lua#L129), adding an extra branch to return a detailed error seems a little bit ugly.

[hbagdi]

Suggested change

	- **JWT**: JWT plugin now denies a request that has different tokens in the jwt token search locations.
	- **JWT**: JWT plugin now denies a request that has different JWTs in the HTTP request header and Query parameter.

[vm-001]

There are three search locations, which are querystring(query parameter), header, and cookie.