These fields are here to allow the component verifying the ticket to identify the key used for the signature.
jku is an URI that reference the public key used for generating the signature. It must follow RFC7517 format. The entity verifying the token is responsible for checking whether that signing key can be trusted or not.
kid is the key identification and it's only valid in the context of a given audience: the context of your application must define how to use that parameter to identify the key. It can be the fingerpring of the x509 cert user for signing, it can be the certificat serial number, it can be a reference to a row in a table, it can be the ID of a HMAC secret stored into a JSON file, or the XPath inside a XML document, whatever is defined by the signing party.
x5u must contain an URL to the x509 certificate that was used for signing the token. That certificate must be in PEM format.
Typically, you will only have one of these parameters in any given token (there can only be one signing key, after all) although it isn't impossible to have the same key accessible through different methods (this mostly means that it's not impossible to have both a jku and a x5u header that point to the same key but you should try to avoid that kind of ambiguity).
By definition, if someone changes the headers and signs the ticket again, the result is not the same token so you don't need to worry about that: you can safely reject any token that you can't properly validate.