Databroker disclosure and tampering via incomplete JWT validation

Incorrect authorization in Pomerium before 0.27.1 allows remote authenticated users to read or alter databroker state via gRPC. RequireSignedJWT accepted any correctly signed token carrying a future exp claim because it did not reject additional JWT claims, so service account tokens passed databroker authorization. Exposure requires a Pomerium Zero or Enterprise service account token with a future expiration and a databroker gRPC API not protected by network access controls; successful access enables user-data disclosure, session spoofing, and policy or route tampering.