v3.3.0

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #2280
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @dependabot[bot] in #2283
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @dependabot[bot] in #2287
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @dependabot[bot] in #2290
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @dependabot[bot] in #2293
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @dependabot[bot] in #2301
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in #2299
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #2306
• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #2316
• build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by @dependabot[bot] in #2319
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @dependabot[bot] in #2321
• [v3] deprecate AlgorithmsForKey, move to internal by @lestrrat in #2326
• [v3] add jws.WithStrictECDSA sign option by @lestrrat in #2328
• [v3] fix curve inference claim in docs by @lestrrat in #2330
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @dependabot[bot] in #2332
• add example for bounded WithWaitReady wait by @lestrrat in #2343
• show fetch failure cause via error sink by @lestrrat in #2344
• [v3] escape JSON object member names on output by @lestrrat in #2349

Full Changelog: v3.2.0...v3.3.0