Thibaultmh/proposed fix to decode id token without kid in alg header

[thibault-tiro]

DO NOT SEND ANY SECURITY FIX HERE. Please read "Security Reporting" section on README.

What kind of change does this PR introduce? (check at least one)

• [X] Bugfix
• [ ] Feature
• [ ] Code style update
• [ ] Refactor
• [ ] Other, please describe:

Does this PR introduce a breaking change? (check one)

• [ ] Yes
• [X] No

---

• [X] You consent that the copyright of your pull request source code belongs to Authlib's author.

[axelv]

First of all thx for maintaining this awesome library. Any perspective on when this PR will be released?

[lepture]

Thanks for the fix.

[FrancisRalph]

Was about to raise a PR for this, thanks! Would it be possible to bump the version? @lepture