fix: jwt_decode_verify missing iss while required (#5919)

jwt_decode_verify function has a bug that permits missing "iss" property of a token even when "iss" is required.
This change fixes this bug - when "iss" property is passed as a constraint, a token with missing "iss" is not allowed.

Fixes #5850

Signed-off-by: Aleksander Brzozowski <olek.brzozowski@gmail.com>