fix(isJWT): reject tokens with an empty header or payload segment

[spokodev]

isJWT accepts tokens whose header or payload segment is empty, e.g. isJWT('..'), isJWT('.<payload>.<sig>') and isJWT('<header>..<sig>') all return true.

Per RFC 7519 / RFC 7515 the JOSE header (a JSON object that must contain alg) and the payload are base64url encodings of non-empty JSON, so neither can be empty; only the signature may be empty (unsecured JWS, alg: none). The empty segments slip through today because isBase64('') returns true.

This adds a guard requiring the header and payload segments to be non-empty, leaving the empty-signature (<header>.<payload>.) case untouched. Tests added to the existing invalid set.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a79ff98) to head (66622ba).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2875   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2601    +2     
  Branches       658       659    +1     
=========================================
+ Hits          2599      2601    +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.