Add validation to prevent asymmetric keys from being used as secrets for non-asymmetric algorithms

[mark-adams]

We should validate that the secret is not a asymmetric key or certificate for HMAC.

Example:
Create an HS256 token. Generate the HMAC signature using the literal bytes of the public key file (often in the PEM format). This will confuse the implementation into interpreting the public key file as an HMAC key.