Verify AppIdentityService signatures against all valid certificates

[wiz]

[Background]
The appengine-plugin in this repo overrides the built-in uploading functionality of WordPress to use a GCS bucket for the WP media library storage backend. The plugin implements an authentication method using the AppIdentityService::signForApp() method to generate a signature using the GAE project's private keys, and verifies media uploads with these signatures being passed via a query string argument.

[Issue]
The authentication method currently verifies the signatures in each media upload by generating the same data to be signed, calling signForApp() and signing it, and comparing the user-provided signature against the one it generates for the request. However, this incorrectly assumes that the generated signature will be the same every time. Since GAE projects can sometimes have more than 1 private key, there can be multiple valid signatures, so this causes the authentication method to randomly fail. As a result, when a user uploads multiple media files, the uploads will fail and the user will get logged out of the WP admin panel.

To quote the AppIdentityService PHP documentation: "Since private keys are rotated periodically, getPublicCertificates() could return a list of public certificates. It's the caller's responsibility to try these certificates one by one when doing signature verification."

[Fix]
This pull request modifies the authentication method to verify a given signature against the correct key.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If your company signed a CLA, they designated a Point of Contact who decides which employees are authorized to participate. You may need to contact the Point of Contact for your company and ask to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the project maintainer to go/cla#troubleshoot.
• In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again.

[wiz]

@googlebot I signed it

[googlebot]

CLAs look good, thanks!