Port jsonwebtoken nonce verification semantics

Scope

Port Bun corpus position 4027, js/third_party/jsonwebtoken/option-nonce.test.js.

Acceptance criteria

• Nonce verification accepts a matching non-empty string.
• Booleans, null, numbers, non-finite values, empty/whitespace strings, arrays, and objects fail with the exact upstream validation message.
• Missing or mismatched nonce claims fail with an upstream-compatible expectation message.
• Nonce failures retain concrete JWT error identity, claim/operation metadata, original cause, and operation-aware cause stacks.
• Focused, adjacent JWT, and permanent diagnostics pass.

Completed in 02089daaa and pushed to main.

Home now passes Bun corpus position 4027, option-nonce.test.js, at 18/18. Verification accepts an exact matching non-empty string and rejects booleans, null, finite/non-finite numbers, empty/whitespace strings, arrays, and objects with the exact upstream message. Missing or mismatched claims produce jwt nonce invalid. expected: <nonce>.

Nonce failures retain concrete JsonWebTokenError identity, ERR_JWT_VERIFY, claim nonce, operation jsonwebtoken.verify, original cause, and readable operation/cause stacks.

Verification:

• focused nonce file: 18/18
• permanent third-party diagnostic contracts: 16/16
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed