acme/api: reject General JSON Serialization JWS bodies per RFC 8555

[SAY-5]

Summary

Fixes #2642.

RFC 8555 section 6.2 mandates that ACME JWS bodies MUST use the Flattened JSON Serialization. go-jose/v3's ParseSigned accepts both Flattened and General forms, so step-ca silently accepted:

{"payload": "...", "signatures": [{"protected": "...", "signature": "..."}]}

as if it were a legal RFC 7515 flattened body. As the reporter notes, go-jose doesn't expose a way to restrict this, so the check has to sit at the JSON layer before jose.ParseJWS runs.

Fix

Add a lightweight rejectGeneralJWS helper in front of parseJWS that JSON-probes the body for a top-level "signatures" array (plural, the telltale General-form field). Hit → return ACME ErrorMalformedType with a message pointing back to RFC 8555. Bodies that aren't valid JSON fall through to the existing ParseJWS path so go-jose's own diagnostics still produce the familiar compact JWS format must have three parts error for compact-serialization mistakes.

Tests

• New sub-test TestHandler_parseJWS/fail/general-jws drives a General-form body through parseJWS and asserts 400 ErrorMalformedType with the RFC-8555-pointing message.
• Existing fail/read-body-error, fail/parse-jws-error, and ok cases stay green.

go build ./acme/..., go vet ./acme/..., go test ./acme/api -run TestHandler_parseJWS all green.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Skyb0rg007]

You should also assert that the message doesn't include the unprotected header

Suggested change

	Signatures json.RawMessage `json:"signatures"`
	Signatures json.RawMessage `json:"signatures"`
	Header json.RawMessage `json:"header"`

[SAY-5]

Good catch. rejectGeneralJWS now also rejects a top-level "header" member (the JWS Unprotected Header, forbidden by RFC 8555 section 6.2), with a matching test case. 880c12c.