Authentication bypass via whitespace-prefixed RSA key

JWT algorithm confusion in Nearform fast-jwt 6.1.0 and earlier allows remote attackers to forge accepted tokens with an RSA public key. The publicKeyPemMatcher in src/crypto.js matches only at position zero, so leading whitespace makes performDetectPublicKeyAlgorithms misclassify an RSA public key as an HMAC secret. Exploitation requires RS256 verification with a whitespace-prefixed public key, no explicit algorithm allowlist, and knowledge of that public key; accepted attacker-chosen claims can bypass authentication and authorization.