Fix case-sensitive JWT claim filtering bypass

[garrytrinder]

Summary

Fixes a security bypass in JwtIssuer.CreateSecurityToken where restricted JWT claims could be injected using mixed-case keys (e.g. SCP, ROLES) because Dictionary.Remove() uses case-sensitive matching by default.

Problem

The claim filtering logic used case-sensitive Remove() calls:

_ = claimsToAdd.Remove("scp");
_ = claimsToAdd.Remove("roles");

An attacker could bypass this by passing --claims "SCP:admin" or --claims "ROLES:SuperUser", resulting in a signed token containing elevated privileges.

Fix

Replace the mutable Remove() approach with a HashSet<string>(StringComparer.OrdinalIgnoreCase) containing all restricted claim names, then filter claims via .Where() before adding them to the identity. This:

1. Blocks restricted claims regardless of casing
2. Avoids mutating the input dictionary as a side effect

[Copilot]

Pull request overview

This PR addresses a security bypass in Dev Proxy’s JWT issuance path by ensuring restricted claim names cannot be injected via mixed-case keys when generating tokens.

Changes:

• Replaces case-sensitive Dictionary.Remove() filtering with a case-insensitive restricted-claim set.
• Filters custom claims via Where(...) to avoid mutating the input claims dictionary while blocking restricted keys (including scp/roles) regardless of casing.