fix(auth0): use jose to decode id_token sub claim for cache key

Replace manual base64 JWT decoding with jose's decodeJwt for
correctness and consistency with other auth modules. Add jose
as a dependency.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>

yarn.lock

@@ -4199,6 +4199,7 @@ __metadata:
     "@types/passport-auth0": "npm:^1.0.5"
     "@types/passport-oauth2": "npm:^1.4.15"
     express: "npm:^4.22.0"
+    jose: "npm:^5.0.0"
     passport: "npm:^0.7.0"
     passport-auth0: "npm:^1.4.3"
     passport-oauth2: "npm:^1.6.1"