Port jsonwebtoken algorithm-confusion defenses

Scope

Port Bun corpus position 4022, js/third_party/jsonwebtoken/jwt.malicious.test.js.

Acceptance criteria

• HS verification rejects RSA KeyObjects and RSA PEM strings even when both HS256 and RS256 are allowlisted.
• Verification validates key material without invoking attacker-controlled toString methods.
• Algorithm allowlists and key-family checks run before signature comparison.
• Key-policy failures retain concrete JWT error identity, claim/operation metadata, original cause, and operation-aware cause stacks.
• Focused, HMAC/asymmetric regressions, and permanent diagnostics pass.

Completed in 8201dda93 and pushed to main.

Home now passes Bun corpus position 4022, jwt.malicious.test.js, at 3/3. Verification enforces the header algorithm allowlist and key family before signature comparison, rejecting RSA KeyObjects and RSA PEM strings for HS256 even when HS256 and RS256 are both allowed. Arbitrary objects are rejected as invalid key material without invoking attacker-controlled toString.

Key-policy failures retain concrete JsonWebTokenError identity, ERR_JWT_VERIFY, claim key, operation jsonwebtoken.verify, original cause, and readable operation/cause stacks.

Verification:

• focused malicious-token file: 3/3
• positions 4020–4022: 53 pass / 6 upstream todo
• permanent third-party diagnostic contracts: 15/15
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed