security: CVE-2025-27144 mitigation for v2.3.1

[developerkunal]

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

🔧 Changes

This PR adds mitigation for CVE-2025-27144, a high-severity DoS vulnerability in go-jose v2.

What's changed:

• Added input validation to reject malicious tokens before parsing
• Tokens with >5 dots are now rejected (protects against memory exhaustion)
• Added 1MB token size limit
• Updated Go to 1.24.0 and golang.org/x/crypto to v0.44.0

New files:

• validator/security.go - validation logic
• validator/security_test.go - security tests (all passing)

This is a defense-in-depth measure. The complete fix will be in v3 with the migration to lestrrat-go/jwx.

📚 References

• CVE-2025-27144: https://www.mend.io/vulnerability-database/CVE-2025-27144
• Severity: HIGH (7.5)
• go-jose v2 is archived and won't be patched

🔬 Testing

All tests pass including new security tests:

• Valid tokens (2-5 dots) are accepted
• Malicious tokens (6+ dots) are rejected
• Tokens >1MB are rejected
• No breaking changes to existing functionality

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.13%. Comparing base (5357b45) to head (0613b05).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #344      +/-   ##
==========================================
+ Coverage   96.66%   97.13%   +0.46%     
==========================================
  Files           8        9       +1     
  Lines         390      314      -76     
==========================================
- Hits          377      305      -72     
+ Misses         10        6       -4     
  Partials        3        3              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.