Update npm dependencies, Node, GitHub Actions; swap out keycloak-connect for jsonwebtoken

[norrisng-bc]

Description

• Update Node to latest LTS
• Update npm dependencies
  • Swap out keycloak-connect for jsonwebtoken (it's since been deprecated)
• Update GitHub Actions

https://apps.nrs.gov.bc.ca/int/jira/browse/SHOWCASE-3625

Types of changes

Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the CONTRIBUTING doc
• I have checked that unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Further comments

This PR is largely similar to bcgov/document-generation-showcase#95, but with the addition of unit tests for the replacement authentication middleware.

[github-actions]

Coverage Report (Application)

Totals
Statements:	73% ( 219 / 300 )
Methods:	62.86% ( 22 / 35 )
Lines:	77.5% ( 155 / 200 )
Branches:	64.62% ( 42 / 65 )

[github-actions]

Coverage Report (Frontend)

Totals
Statements:	28.94% ( 112 / 387 )
Methods:	31.48% ( 34 / 108 )
Lines:	32.09% ( 60 / 187 )
Branches:	19.57% ( 18 / 92 )

[TimCsaky]

So to summarize, the authentication flow has changed.
with the old keycloak-connect component, we were verifying that the backend was a valid sso client.
.. but now we're ensuring only the frontend sso client is allowed to call our backend (by cross-checking the audience field) .
This feels like a more secure pattern we weren't even verifying the audience before (my bad). So this all looks good now.

..and the unit tests look great. even if the way mocking specific implementations of a function is not a reliable design.. i think it's the best we have.

I now believe the server.keycloak environment variables are redundant and could be removed. but would suggest leaving them there for now. in case we ever use them for something else.