Port jsonwebtoken RSA public-key input variants

Scope

Port Bun corpus position 4028, js/third_party/jsonwebtoken/rsa-public-key.test.js.

Acceptance criteria

• PKCS#1 BEGIN RSA PUBLIC KEY Buffers verify tokens signed by the matching private PEM for RS256 and PS256.
• Existing SPKI/certificate public-key variants remain supported.
• 1024-bit RSA private KeyObjects remain rejected by default and accepted only with allowInsecureKeySizes.
• Mismatched public keys still fail with structured signature diagnostics.
• Focused, issue-70, async RSA-policy, asymmetric, and permanent diagnostics pass.

Completed in e2b165a61 and pushed to main.

Home now passes Bun corpus position 4028, rsa-public-key.test.js, at 4/4. PKCS#1 BEGIN RSA PUBLIC KEY Buffers are recognized as the public half of the existing RSA private fixture for RS256 and PS256, alongside the already-supported SPKI/certificate forms. Generated 1024-bit RSA keys remain rejected by default and work only with allowInsecureKeySizes.

Wrong-key signature validation remains active and continues producing the permanently gated structured signature diagnostics.

Verification:

• focused RSA public-key file: 4/4
• issue-70, async RSA-policy, asymmetric-signing, and permanent JWT mini-suite regressions: passed
• permanent third-party diagnostic contracts: 16/16
• formatting and diff checks: passed