Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

The live tests reached one shared bus and assert, read and remove the mesh's own objects by
their fixed names, so packages run in parallel deleted what each other read and the suite
passed only one package at a time; a red suite read as noise. internal/testbus starts a server
per test, linked in at the nats-server release go.mod pins, and a test holds that pin to the
catalogue's bus image and to the facts snapshot's bus when there is one, so the tests never run
a bus the mesh does not. The waiter test read a timing (the most connections held at one look)
and now reads the state it means (the fewest held across the wait). make check runs the packages
in parallel under the race detector, with a timeout.

vendor/github.com/nats-io/jwt/v2/decoder.go

@@ -0,0 +1,173 @@
+/*
+ * Copyright 2020-2022 The NATS Authors
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/nats-io/nkeys"
+)
+
+const libVersion = 2
+
+// MaxTokenSize is the maximum size of a JWT token in bytes
+const MaxTokenSize = 1024 * 1024 // 1MB
+
+// ErrTokenTooLarge is returned when a token exceeds MaxTokenSize
+var ErrTokenTooLarge = errors.New("token too large")
+
+type identifier struct {
+	Type          ClaimType `json:"type,omitempty"`
+	GenericFields `json:"nats,omitempty"`
+}
+
+func (i *identifier) Kind() ClaimType {
+	if i.Type != "" {
+		return i.Type
+	}
+	return i.GenericFields.Type
+}
+
+func (i *identifier) Version() int {
+	if i.Type != "" {
+		return 1
+	}
+	return i.GenericFields.Version
+}
+
+type v1ClaimsDataDeletedFields struct {
+	Tags          TagList   `json:"tags,omitempty"`
+	Type          ClaimType `json:"type,omitempty"`
+	IssuerAccount string    `json:"issuer_account,omitempty"`
+}
+
+// Decode takes a JWT string decodes it and validates it
+// and return the embedded Claims. If the token header
+// doesn't match the expected algorithm, or the claim is
+// not valid or verification fails an error is returned.
+func Decode(token string) (Claims, error) {
+	if len(token) > MaxTokenSize {
+		return nil, fmt.Errorf("token size %d exceeds maximum of %d bytes: %w", len(token), MaxTokenSize, ErrTokenTooLarge)
+	}
+	// must have 3 chunks
+	chunks := strings.Split(token, ".")
+	if len(chunks) != 3 {
+		return nil, errors.New("expected 3 chunks")
+	}
+
+	// header
+	if _, err := parseHeaders(chunks[0]); err != nil {
+		return nil, err
+	}
+	// claim
+	data, err := decodeString(chunks[1])
+	if err != nil {
+		return nil, err
+	}
+	ver, claim, err := loadClaims(data)
+	if err != nil {
+		return nil, err
+	}
+
+	// sig
+	sig, err := decodeString(chunks[2])
+	if err != nil {
+		return nil, err
+	}
+
+	if ver <= 1 {
+		if !claim.verify(chunks[1], sig) {
+			return nil, errors.New("claim failed V1 signature verification")
+		}
+	} else {
+		if !claim.verify(token[:len(chunks[0])+len(chunks[1])+1], sig) {
+			return nil, errors.New("claim failed V2 signature verification")
+		}
+	}
+
+	prefixes := claim.ExpectedPrefixes()
+	if prefixes != nil {
+		ok := false
+		issuer := claim.Claims().Issuer
+		for _, p := range prefixes {
+			switch p {
+			case nkeys.PrefixByteAccount:
+				if nkeys.IsValidPublicAccountKey(issuer) {
+					ok = true
+				}
+			case nkeys.PrefixByteOperator:
+				if nkeys.IsValidPublicOperatorKey(issuer) {
+					ok = true
+				}
+			case nkeys.PrefixByteUser:
+				if nkeys.IsValidPublicUserKey(issuer) {
+					ok = true
+				}
+			case nkeys.PrefixByteServer:
+				if nkeys.IsValidPublicServerKey(issuer) {
+					ok = true
+				}
+			}
+		}
+		if !ok {
+			return nil, fmt.Errorf("unable to validate expected prefixes - %v", prefixes)
+		}
+	}
+	return claim, nil
+}
+
+func loadClaims(data []byte) (int, Claims, error) {
+	var id identifier
+	if err := json.Unmarshal(data, &id); err != nil {
+		return -1, nil, err
+	}
+
+	if id.Version() > libVersion {
+		return -1, nil, errors.New("JWT was generated by a newer version ")
+	}
+
+	var claim Claims
+	var err error
+	switch id.Kind() {
+	case OperatorClaim:
+		claim, err = loadOperator(data, id.Version())
+	case AccountClaim:
+		claim, err = loadAccount(data, id.Version())
+	case UserClaim:
+		claim, err = loadUser(data, id.Version())
+	case ActivationClaim:
+		claim, err = loadActivation(data, id.Version())
+	case AuthorizationRequestClaim:
+		claim, err = loadAuthorizationRequest(data, id.Version())
+	case AuthorizationResponseClaim:
+		claim, err = loadAuthorizationResponse(data, id.Version())
+	case "cluster":
+		return -1, nil, errors.New("ClusterClaims are not supported")
+	case "server":
+		return -1, nil, errors.New("ServerClaims are not supported")
+	default:
+		var gc GenericClaims
+		if err := json.Unmarshal(data, &gc); err != nil {
+			return -1, nil, err
+		}
+		return -1, &gc, nil
+	}
+
+	return id.Version(), claim, err
+}