CVE-2024-28176 — jose (JWT library) compressed-payload DoS

The `jose` JWT library (used by next-auth and Clerk and others) decompressed JWE tokens without size limits, allowing a compressed-payload DoS.