feat: opt-in claim validation (--verify-claims, --aud, --iss)

[bsg62]

Implements #1 from the improvement list: optional, explicit claim validation that can affect the exit code — without changing the default decode-only behavior.

Behavior

• --verify-claims validates the temporal claims (exp, nbf) and exits nonzero if the token is expired or not yet valid.
• --aud <value> / --iss <value> additionally require a specific audience/issuer and imply validation (so they work without also passing --verify-claims).
• The verdict prints as a Claims: VALID / Claims: INVALID section with the reason, and as claimsValid under --json.

$ jwtd --verify-claims <expired-token>
...
Claims: INVALID
  token is expired          # exit 1

Design decisions

• Independent of signature verification. Claim validation performs no cryptography and runs with or without --key. When both are used, both sections are shown and the command exits nonzero if either fails (signature verdict takes precedence for the returned sentinel). This preserves the existing invariant that a bare decode never fails on expiry — nothing validates claims unless a claim flag is passed.
• Shared clock. Uses go-jwt's jwt.NewValidator with jwt.WithTimeFunc(timeNow), so verdicts agree with the existing expired / not yet valid display annotations and are deterministic under the pinTime test helper. Reusing the library's validator avoids reimplementing crypto-adjacent checks.
• Missing exp is not expired (standard JWT semantics); no leeway (matches the exact-time annotations).
• JWT-only. Claim flags on a JWE emit a stderr note and are skipped (JWE claims live in the encrypted payload).
• Low churn. decodeAndPrint is untouched; the human path runs claim validation as a separate section via a new decodeJWTHuman, and only decodeJWTJSON gained the claimChecks parameter.

Tests

New claims_test.go covers validateClaimsSet (live/expired/not-yet-valid, aud/iss match·mismatch·missing, joined multi-failures, missing-exp-is-valid), verifyClaims (VALID/INVALID output, sentinel, hard error on unparseable token), claimReason flattening, and integration through decodeJWTHuman / decodeJWTJSON (section ordering, both-checks precedence, claimsValid omitted when not requested). Full suite + go vet + gofmt clean.

Follow-up (not in this PR)

The marketing site's capabilities list still says signatures are checked "independently from claim validation"; adding a claim-validation capability entry there is a separate docs change I've left out to keep this PR focused.

🤖 Generated with Claude Code