Create testing suite targeting auth.js in API

[Matte22]

this discussion was started based on #1517

This should probably become its own new section of our tests directory structure.

• We need to add tests in a CI workflow (via binaries) to bring up the API with specific environment values and validate how config.oauth.claims are handled. These tests should query the API to get some of these values back.

• Ensure proper error handling when tokens fail at:

  • jwt.decode()
  • jwt.verify()

Test Cases:

• Provide the API with a handcrafted invalid token and verify that it is correctly rejected.
• Generate a valid JWT but set the exp (expiration) claim in the past.
• Modify the kid field in the JWT header to a non-existent key.
• Send tokens that lack required claims
• Provide a valid token with incorrect or insufficient scopes? (not sure if this should be done)