benmcollins libjwt

• CVE-2026-44699 Critical 9.1 LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC 0.3%
• CVE-2026-33996 Medium 5.8 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing 0.2%