Move jws to an internal repo

[rakyll]

Package jws is misleading the users that it might be a full JWS implementation even though it is a partial implementation to implement the JWT flow.

Due to the fact we promised not to break any APIs, we cannot move this package to the internal right away. Good news is that, according to the public Github usage, there are very few instances of the jws package is being imported.

We should contact to those repos and ask them to vendor the package if they would like to keep depending on it. I have no information about the usage in private repos but I assume it is not a popular package.

/cc @broady @bradfitz

The current instances of the jws use:

vanadium/go.ref,services/allocator/allocatord/oauth.go,e8dcce40994e8d21960dede875203a005b2b6ce9
the-information/ori,account/auth/middleware.go,d94007bded4eeb243825171d117d4982eed9c296
luci/luci-go,tokenserver/appengine/services/admin/serviceaccounts/service.go,42696ec393fe507df6dc52cff1a993f513ca2c60
the-information/ori,test/jwt.go,462c3148f6dd2b4cf3e5b542df759a814d5d96fb
the-information/ori,test/handler.go,8c5f15e5331ea1f5c432fc98ea3ac3e16033a936
the-information/ori,account/auth/auth_test.go,21a9190f6a087e27179586f4ba06a04d0f2401df
the-information/ori,account/auth/auth.go,2f7ed3494f376f9a81522aa5cafb978c3e1ab7e6
jitsi/jap,jap.go,7d9daf86b306610f40cee05619acb0ddfe429e8a
jitsi/jap,google.go,feaaab385b86850cdf69b1420269198f4f39bb47
jitsi/jap,jap_test.go,9f918e044cb0f822e90228d3978a8d66d9277a73
GoogleCloudPlatform/golang-samples,docs/managed_vms/endpoints/client/main.go,d39ed3c5c1bc33ae75c90eb2f4af118d34ef576c
the-information/ori,account/auth/middleware_test.go,5c699134e6c0053b682281d0fd4bd5f4c00d8ed9
the-information/ori,admin/admin.go,e68c87a894f2c1c889cdc25968a7881fba41ad3c

[rakyll]

And there are a few non-Github importers: https://godoc.org/golang.org/x/oauth2/jws?importers

[bradfitz]

Start by adding a warning notice to the top of the package doc, and then that locks down the list of people we need to responsibly notify.

If anybody new comes along after the package doc, it's their fault.

[rakyll]

Given that jws.Verify is a requirement to verify ID tokens during 2-legged flows, we should keep it around.

[riclage]

Given that jws.Verify is a requirement to verify ID tokens during 2-legged flows, we should keep it around.

@rakyll is it safe to still use this package to verify id tokens? In the case of google id tokens, I only find one alternative other than maintaining my own verification implementation: To use the tokeninfo endpoint. But that is not ideal either since it requires an extra network call.