Unauthenticated session revocation via unverified token claims

Cryptographic signature verification failure in Guardian 1.0.0 through 2.4.0 allows remote attackers to revoke victim sessions. Guardian.revoke/3 passes claims decoded by the non-verifying peek/1 function to state-mutating revoke and on_revoke callbacks. No authentication is required, but exploitation requires known or guessed jti or sub claims, a caller-supplied token path, and a state-mutating token module; the default no-op callback is not exploitable.