Fix: jwt.decode doesn't throw, check null instead

[glensc]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

I can not find from jsonwebtoken.decode where it would throw:

• https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/decode.js#L3-L30

but it does return null, which was not checked.

The same goes for jws.decode, it returns null rather than throwing:

• https://github.com/auth0/node-jws/blob/master/lib/verify-stream.js#L57-L78

Checklist

• This change adds test coverage for new/changed/fixed functionality
• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[glensc]

jws.decode has one code path that can throw:

• Fix: Catch errors from JSON.parse node-jws#107

that should be merged first.