fix(isJWT): reject tokens with an empty header or payload segment

[spokodev]

isJWT accepts tokens whose header or payload segment is empty, e.g. isJWT('..'), isJWT('.<payload>.<sig>') and isJWT('<header>..<sig>') all return true.

Per RFC 7519 / RFC 7515 the JOSE header (a JSON object that must contain alg) and the payload are base64url encodings of non-empty JSON, so neither can be empty; only the signature may be empty (unsecured JWS, alg: none). The empty segments slip through today because isBase64('') returns true.

This adds a guard requiring the header and payload segments to be non-empty, leaving the empty-signature (<header>.<payload>.) case untouched. Tests added to the existing invalid set.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a79ff98) to head (66622ba).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2875   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2601    +2     
  Branches       658       659    +1     
=========================================
+ Hits          2599      2601    +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nrps9909]

Reviewed 66622ba31e8241eb36a12b6390112464416c9e28.

Confirmed the three empty-header/payload examples are accepted on base a79ff98 and rejected on this head. I also checked the compatibility boundary explicitly: eyJhbGciOiJub25lIn0.e30. (an alg: none header, an empty JSON claims object, and an empty signature) remains accepted, consistent with RFC 7519 section 6. Two/four segments remain rejected, and non-string input still throws.

The same seven-case probe passed against source, the generated Node and ES module entry points, and both browser bundles (35 checks, plus non-string checks for each form). npm test also passed: all builds, lint, 323 tests, and 100% statements/functions/lines. The current upstream Node 8–24 checks are green.

No blocking findings for this structural empty-segment fix.