This is a relatively common pattern which is hard to get right.

`validate_jwks_uri` already checks that `jwks_uri` is set.

AFAICT from the RFCs (https://tools.ietf.org/html/rfc8414), `jwks` is not a
field that can be returned from the metadata endpoint, so this is entirely an
internal cache. The object is opaque enough without us inventing extra things
to store in it, so let's move it out.

Ensure that we lock correctly to prevent multiple concurrent metadata load
requests, and generally clean up the way we construct the metadata cache.