joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) (CVE-2026-49852) | HOL Guard CVE