Update LMS private key JWKs to prepare for pyjwkest removal

[timmc-edx]

As part of openedx/edx-drf-extensions#290 we need to update our JWKs to be forward-compatible with PyJWT, which requires that either all optional params are present in an RSA JWK, or none are. (With pyjwkest, we've been able to get away with having a partial list of these precomputed values.)

In openedx/edx-platform#31927 we determined that the likely least-friction method of upgrading is to update the private keys in-place to include all of the precomputed private numbers:

• For each environment, upgrade the existing private key using feat: Add a script to enhance JWKs in preparation for move from pyjwkest openedx/edx-platform#32089
  • devstack
  • stage
  • prod
  • edge
  • sandbox - maybe N/A, see https://github.com/edx/sandbox-internal/pull/289 -- sandboxes seem to create their own keypair at setup time
• For each environment, remove any old public keys
  • devstack - N/A
  • stage: https://github.com/edx/edx-internal/pull/8235
  • prod: https://github.com/edx/edx-internal/pull/8240
  • edge: https://github.com/edx/edge-internal/pull/520
  • sandbox
• Ensure we have a ticket to update generate_jwt_signing_key to produce keys with all optional params included
  • Remove pyjwkest from generate_jwt_signing_key openedx/edx-platform#32125
• Update the Release Notes to ask deployers to follow this procedure: https://openedx.atlassian.net/wiki/spaces/COMM/pages/3726802953/Next+Release+Quince

[robrap]

@rgraber may be able to help @timmc-edx as eSRE.

[rgraber]

Yes, I can do this. I ran it by SRE just to be sure and they told me to go for it.

[rgraber]

@timmc-edx am I correct in assuming I should also do this for sandboxes?

[rgraber]

We have decided to update the key rather than roll it since it requires less e/SRE intervention. This is blocked on getting the decrypted private key from SRE, who have it in their sprint.

[rgraber]

Follow up ticket for updating generate_jwt_signing_key is openedx/edx-platform#32125 . Sandboxes use this to generate keys on provisioning, so updating the script should update sandboxes as well.