throwError does not throw on invalid signature

[stephent]

The readme states:

throws

If options.throwError is true and the token is invalid, an error will be thrown.

But the verify method does not throw if the following line returns false, even if throwError is true:

cloudflare-worker-jwt/src/index.ts

Line 232 in 8a75c24

return await crypto.subtle.verify(algorithm, key, base64UrlToArrayBuffer(tokenParts[2]), textToArrayBuffer(`${tokenParts[0]}.${tokenParts[1]}`))

This could result in invalid JWTs being mistakenly accepted, if the caller assumes they can simply try/catch with throwError passed as true and don't also check the return value.

[stephent]

See also #76 - the code shown there appears to make exactly this incorrect assumption.