make jwks optional

make jwk optional and regroup config under the jwk key.

upload is not protected if no jwk is provided (for development or because it is protected upstream)

jwk:
  keys: ""
  claims:
    iss: ""
    project_path: ""
    ref_protected: ""