fix(fm): fetch Keycloak signing keys from FM_KEYCLOAK_JWKS_URL when set

The issuer must be the public URL partners' tokens carry, which FM often
can't reach from inside its pod, so every EWBI call failed with 401. Let a
deployment point FM at Keycloak's internal address for the keys; the issuer
check is unchanged.