There are some 2021-edition crates that Cargo was warning about.

So it's Base64<PEM bytes>, not just PEM bytes.

The JWT spec [1] basically says that JWTs must validate the `aud` claim
if its specified:

> If the principal
> processing the claim does not identify itself with a value in the
> "aud" claim when this claim is present, then the JWT MUST be
> rejected.

[1]: https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3

Since we now validate the `sub` and `nbf` claims, they need to be set
when atticadm generates them.

…serializing `false` permissions

This effectively reverts commit 3e0b65a.

Because jwt_simple doesn't have a unified type / trait that allows
signature and verification, I had to add a SignatureType enum to
approximate that.

This does make it decode the keys every iteration in the stability
test, which isn't too much of an issue and can be fixed later.

…56 config