go-oidc's RemoteKeySet puts the JWKS endpoint's response body in its error
for non-200 and malformed 200 responses; Verify wrapped it and the callback
logged it. verifyError now keeps only a fixed category, plus the expiry for
an expired token. A test with a sentinel JWKS body checks it reaches
neither the returned error, the response nor the logs.
Addresses feature-review finding F03-03 on PR #24.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>