Verifies Apple id_token JWTs using Apple's JWKS endpoint.

This module validates signature, issuer, audience, expiry, subject, optional email verification, and nonce.

:client_ids must be passed by the host app.