feat: implement minimum key length validation for HMAC and RSA algorithms

[amanjolhe]

Security Fix: CVE-2025-45768 - Implement Minimum Key Length Validation

This PR addresses CVE-2025-45768 by implementing minimum key length requirements for HMAC and RSA algorithms per RFC 7518 and NIST SP800-117.

Changes:

• ✅ HMAC algorithms now enforce minimum key lengths:
  • HS256: 32 bytes minimum
  • HS384: 48 bytes minimum
  • HS512: 64 bytes minimum
• ✅ RSA algorithms now enforce 2048-bit minimum key size
• ✅ Enhanced key validation in prepare_key() and from_jwk() methods
• ✅ Comprehensive test suite with 310 passing tests
• ✅ Updated all test secrets to meet new requirements

Breaking Change:

Keys below minimum length requirements will now be rejected with InvalidKeyError.

Fixes CVE-2025-45768

[Copilot]

Pull Request Overview

This PR addresses CVE-2025-45768 by implementing minimum key length validation for HMAC and RSA algorithms in compliance with RFC 7518 and NIST SP800-117 security standards.

• Enforces minimum key lengths for HMAC algorithms (HS256: 32 bytes, HS384: 48 bytes, HS512: 64 bytes)
• Enforces minimum 2048-bit key size for RSA algorithms
• Updates all test secrets to meet the new security requirements

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
jwt/algorithms.py	Implements key length validation in HMACAlgorithm and RSAAlgorithm classes
tests/test_algorithms.py	Adds comprehensive tests for the new key validation logic
tests/test_jwt.py	Updates test secrets to meet minimum requirements
tests/test_api_jwt.py	Updates test secrets and JWT tokens to use compliant keys
tests/test_api_jws.py	Updates test secrets and expected signatures for longer keys
tests/test_compressed_jwt.py	Updates test secrets and JWT token for compression tests

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[amanjolhe]

Hi @auvipy , do we need to take care of those failing checks ? or should we discuss next steps?