Allow both x5c/jwk and kid in header in JWS

[TimoGlastra]

It's fine to include both. We should tweak the logic, as we now assume kid = did. But it can be a did, but also a kid that is assocaited with e.g. a jwk or a x5c.

Need to make sure it can't lead to confusion attacks, where multiple valid key references are present and they can 'trick' our implementation to (e.g. x5c is present, but we only verified the kid with a did).

So we should probably first check for either jwk or x5c. Then optionally it can have a kid but that's meaningless in that case (just an identifier). Otherwise if both are not present, we expect the kid to be a did url.