Add pluggable JSONMapper SPI for custom JSON serialize/deserialize

[ribhav-pahuja]

Summary

• Introduce a JSONMapper SPI so applications can plug in a custom JSON library (e.g. Gson) instead of only Jackson.
• Keep Mapper as the public facade with setMapper / getMapper / resetMapper; default remains JacksonJSONMapper for full backward compatibility.
• Stop using Jackson JsonNode in JWKS well-known discovery so custom mappers do not need Jackson types.
• Document the SPI in the README and CHANGES; add tests that a custom mapper is used for serialize/deserialize and encode/decode.

Resolves #6

Test plan

• mvn test (default JCA + FIPS)
• CustomJSONMapperTest covers set/reset and encode/decode path
• Review that domain Jackson annotations remain sufficient for the default mapper
• Optional follow-up: multi-module packaging / making Jackson optional is intentionally out of scope