fix(security): revert to PyJWT for JWT expiry parsing

Author: BartoszBlizniak

cloudsmith_cli/core/credentials/oidc/cache.py

@@ -7,7 +7,6 @@
 
 from __future__ import annotations
 
-import base64
 import hashlib
 import json
 import logging
@@ -48,13 +47,10 @@ def _decode_jwt_exp(token: str) -> float | None:
     make an authorization decision, so the signature is deliberately not
     verified (the API rejects tampered tokens regardless).
     """
-    parts = token.split(".", 2)
-    if len(parts) != 3:
-        return None
     try:
-        payload_segment = parts[1]
-        padded = payload_segment + "=" * (-len(payload_segment) % 4)
-        payload = json.loads(base64.urlsafe_b64decode(padded))
+        import jwt
+
+        payload = jwt.decode(token, options={"verify_signature": False})
         exp = payload.get("exp")
         if exp is not None:
             return float(exp)