fix: reject + and / in the no-native-fromBase64 decode fallback

[spokodev]

Problem

base64url.decode() decodes the same input differently across runtimes when it contains + or /.

The native path rejects them, since they are not in the Base64URL alphabet:

Uint8Array.fromBase64(input, { alphabet: 'base64url' }) // throws on + or /

The fallback (runtimes without Uint8Array.fromBase64) translates -_ → +/ and decodes via atob, which accepts standard-Base64 + and /:

encoded = encoded.replace(/-/g, '+').replace(/_/g, '/')
return decodeBase64(encoded) // atob accepts + and /

So the same JWS/JWE/JWT segment is accepted on a runtime without the native method and rejected on one with it:

delete Uint8Array.fromBase64
decode('+/+/') // fallback: Uint8Array(3) [251, 255, 191];  native: throws

This is a portability inconsistency rather than a security issue (a forged signature still fails verification), but a given segment should decode the same way on every runtime, and the fallback should match the alphabet the native path already enforces.

Fix

Reject + and / in the fallback before the -_ → +/ translation, so it behaves like the native path. Only those two characters change; the padding and whitespace that atob tolerates are untouched.

Tests

Added a unit test exercising both paths (native, and the fallback forced by removing Uint8Array.fromBase64): +// are rejected and valid base64url still decodes. The fallback case fails on main and passes with the fix.