[Token/JWT] Update to golang-jwt v5.2.0

[an-toine]

Comprehensive Summary of your change

This PR is a follow-up of #19796 and, if validated, could supplant it.

Both PR share a similar goal, providing some leeway around token validity timestamps to account for clock skew on distributed systems.

This time though, this PR is leveraging the built-in leeway attribute brought by the v5 branch of golang-jwt instead of setting a fix offset on claims.

This code should be carefully reviewed, I'm new to the Harbor codebase and I may have missed some key issues during the migration (I used https://github.com/golang-jwt/jwt/blob/main/MIGRATION_GUIDE.md for this task).

Finally, the leeway value was set arbitrarily, we can maybe use an higher value (up to 1 minute) to improve reliability.

Issue being fixed

Fixes #18880

Please indicate you've done the following:

• Well Written Title and Summary of the PR
• Label the PR as needed. "release-note/ignore-for-release, release-note/new-feature, release-note/update, release-note/enhancement, release-note/community, release-note/breaking-change, release-note/docs, release-note/infra, release-note/deprecation"
• Accepted the DCO. Commits without the DCO will delay acceptance.
• Made sure tests are passing and test coverage is added if needed.
• Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

cc @Vad1mo

[codecov]

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (a3e1b1e) 67.45% compared to head (e22a356) 67.45%.
Report is 10 commits behind head on main.

❗ Current head e22a356 differs from pull request most recent head a788b68. Consider uploading reports for the commit a788b68 to get more accurate results

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #19802   +/-   ##
=======================================
  Coverage   67.45%   67.45%           
=======================================
  Files         996      996           
  Lines      109773   109770    -3     
  Branches     2720     2720           
=======================================
+ Hits        74044    74049    +5     
+ Misses      31747    31739    -8     
  Partials     3982     3982           

Flag	Coverage Δ
unittests	67.45% <75.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files	Coverage Δ
src/core/service/token/authutils.go	69.14% <ø> (ø)
src/pkg/token/options.go	47.61% <ø> (ø)
src/server/middleware/security/v2_token.go	64.51% <100.00%> (+11.88%)	⬆️
src/pkg/token/claims/robot/robot.go	83.33% <66.66%> (+0.98%)	⬆️
src/pkg/token/claims/v2/claims.go	75.00% <66.66%> (+5.00%)	⬆️
src/pkg/token/token.go	51.02% <75.00%> (+1.02%)	⬆️

... and 4 files with indirect coverage changes

[MinerYang]

Hi @an-toine ,

Could you help to resolve conflict and rebase the branch as well as update the leeway to 60s as we discussed at your convenience?

Appreciate!

[an-toine]

Hi @an-toine ,

Could you help to resolve conflict and rebase the branch as well as update the leeway to 60s as we discussed at your convenience?

Appreciate!

I've fixed the conflict, rebased, updated leeways and added two test cases to validate change effectiveness.

Antoine

[an-toine]

@MinerYang : can you retest please ?

[MinerYang]

@MinerYang : can you retest please ?

Hi @an-toine ,

Thanks and sorry for the late response since I was just came back from holiday.

[wy65701436]

lgtm

[MinerYang]

Thanks @an-toine for your dedicated contribution!

Best,
Miner