A federated client credential could only point at a JWKS URL, which
requires the assertion issuer to host a discoverable JWKS.
This PR allows an admin to manually import public keys for FIC, so Pocket ID works better in air-gapped environments.
Also fixes an error introduced by #1679 where some text labels were not added to paraglide