JWT security auditor — alg=none, RS256-to-HS256 confusion, HMAC brute force, kid/jku injection · librería importable