Validate the top-level "keys" field in JWK Set import

[rishuranjanofficial]

Problem

JwkSetConverter.toPublicKeysetHandle(String jwkSet) and
SignatureJwkSetConverter.toPublicKeysetHandle(String jwkSet) both wrap only
the initial JSON parse in a try/catch block:

jsonKeyset = JsonParser.parse(jwkSet).getAsJsonObject();
// catches IllegalStateException | IOException

Immediately after, both methods read the top-level "keys" field and
iterate its contents with no further validation, outside of that
try/catch:

JsonArray jsonKeys = jsonKeyset.get("keys").getAsJsonArray();
for (JsonElement element : jsonKeys) {
  JsonObject jsonKey = element.getAsJsonObject();

A well-formed but unexpected JSON input triggers an uncaught
RuntimeException instead of the documented GeneralSecurityException in
three cases:

1. No "keys" field present (input is "{}"): JsonObject.get("keys") returns
   null, and calling .getAsJsonArray() on it throws
   NullPointerException.
2. "keys" present but not an array (e.g. {"keys":"not an array"}):
   JsonElement.getAsJsonArray() throws IllegalStateException.
3. An element of "keys" is not a JSON object (e.g.
   {"keys":["not an object"]}): JsonElement.getAsJsonObject() throws
   IllegalStateException.

Both methods declare a checked-exception contract (GeneralSecurityException,
plus IOException on the JWT variant for backward compatibility), so any
caller written against that contract will not catch these exceptions.

Root cause

Both files already apply a defensive has() / isJsonArray() / isJsonObject()
check before extracting every other field from untrusted JSON, for
example getStringItem() and validateKeyOpsIsVerify() in both files. The
one place this pattern is missing is the very first thing each method
does with the parsed JSON: reading the top-level "keys" array.

This is the same bug class fixed in JsonKeysetReader.java in commit
d9552c8 ("Report malformed JSON keyset fields as IOException instead of
an uncaught exception"), which documents the identical mechanism for a
different accessor (getAsString() rather than getAsJsonArray() /
getAsJsonObject()). That fix did not extend to these two JWK Set
converters.

Fix

Add the missing validation, mirroring the existing
has()/isJsonArray()/isJsonObject() pattern already used elsewhere in both
files, before the "keys" field is read or iterated in each converter.

Testing

Added three regression tests to each of JwkSetConverterTest.java and
SignatureJwkSetConverterTest.java, covering a missing "keys" field, a
non-array "keys" field, and a non-object element inside "keys". All three
previously threw an uncaught RuntimeException and now correctly throw
GeneralSecurityException.

[rishuranjanofficial]

@tholenst

I've submitted this pull request and would appreciate a review when you have some bandwidth. Please let me know if any changes or additional context are needed.

Thank you for your time and consideration.

[rishuranjanofficial]

Gentle follow-up on #76. The fix adds missing has()/isJsonArray()/isJsonObject() guards before the "keys" field is read in both JwkSetConverter and SignatureJwkSetConverter, converting uncaught NullPointerException/IllegalStateException into the documented GeneralSecurityException. Mirrors the same fix already applied in JsonKeysetReader (commit d9552c8). Happy to address any feedback. Thanks!

[rishuranjanofficial]

Update: the top-level keys validation was independently implemented on main in e68db6a (2026-08-12), after I reported it and opened this PR (2026-08-04). I've merged main and adopted its version of the source; this PR now adds regression tests for the three malformed-input cases (missing keys, keys not an array, non-object entry), which assert GeneralSecurityException and pass against the current implementation.