Add ability to set cert thumbprint in JwsBuilder

[dmulder]

Implements # .

• cargo fmt has been run
• cargo test has been run and passes
• documentation has been updated with relevant examples (if relevant)

[dmulder]

This is required for a MS ConfidentialClientApplication.
To authenticate as a "confidential" client in Entra Id:

1. Create an rsa256 key pair (I'm using LoadableRS256Key/RS256Key from hsm-crypto).
2. Self sign a certificate using the rsa256 private key.
3. Upload the self signed certificate to Entra Id for Application certificate authentication.
4. Sign a JWT via the rsa256 private key, formatted as follows:

   {
     "alg": "RS256",
     "kid": "3ee6dfce3de665244ba03b59ecc7d50360fc1655e3d361e0304daca8ed57c700",
     "x5t": "FHBvbp5DupufYzW5TL/qetRR8dg="
   }.{
     "aud": "https://login.microsoftonline.com/6973bb37-65f8-440e-b39e-dd57da64f6cf/oAuth2/v2.0/token",
     "sub": "30adc3ea-f3f4-4c31-942a-8c6a44f46a00",
     "iss": "30adc3ea-f3f4-4c31-942a-8c6a44f46a00",
     "jti": "7519ddb3-c0c8-4de2-9854-27acf6f5ce31",
     "iat": 1751492211,
     "exp": 1751492811
   }.[Signature]
   

   Where the x5t is a base64 encoded sha1 digest of the certificate der (I attempted without this, and it is actually mandatory).
5. Send this JWT in a token request (client_assertion parameter), and MS responds with an access token.