refactor: Full TypeScript rewrite with sync API and security hardening (v10.0.0)

[interpret-tech]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please
see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

This PR completes the TypeScript migration for the jsonwebtoken library (v10.0.0), introducing significant improvements in type safety, security, and developer experience.

Key changes:

• Full TypeScript migration: All source code has been migrated from JavaScript to TypeScript with comprehensive type definitions
• New synchronous API: Added signSync() and verifySync() functions for synchronous operations, addressing long-standing community requests
• Enhanced security: Implemented multiple security hardening measures, including:
• Protection against timing attacks in signature verification
• Strict input validation to prevent prototype pollution
• Enhanced header validation to prevent injection attacks
• Improved key confusion attack prevention
• DOS protection through payload size limits
• Dual module support: Configured for both CommonJS and ESM module systems
• Improved code organisation: Extracted shared logic into reusable modules for better maintainability
• Modern tooling: Updated to use Jest for testing, ESLint flat config, and TypeScript 5.x

Breaking changes:

• Minimum Node.js version is now 20.x
• TypeScript types are now built-in (no need for @types/jsonwebtoken)
• Some internal APIs have changed (see migration guide)
• Error messages have been standardised and improved

References

• Addresses multiple long-standing issues regarding TypeScript support and synchronous API requests
• Implements security recommendations from various vulnerability reports
• Follows Auth0's security best practices for JWT implementations

Testing

The entire test suite has been reorganised and expanded:

To test this PR:

# Install dependencies
npm install

# Run linting
npm run lint

# Run type checking
npm run type-check

# Run tests with coverage (requires 95%+ coverage)
npm run test:coverage

# Run full test suite
npm test

Testing coverage includes:
- All JWT operations (sign, verify, decode) with both async and sync variants
- All supported algorithms (HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, none)
- Security attack scenarios (timing attacks, key confusion, prototype pollution, header injection)
- Edge cases for timestamps, expiration, and claims validation
- Compatibility with various key formats (PEM, JWK, symmetric keys)

###Development environment:
- Node.js 20.x
- TypeScript 5.x
- macOS/Linux/Windows compatible
- This change adds test coverage for new/changed/fixed functionality

###Checklist
- I have added documentation for new/changed functionality in this PR or in auth0.com/docs