Summary

• Integrity: Reject ‘crit’ in unprotected headers during JSON serialize/deserialize (RFC 7515 §4.1.11).
• Type: Require ‘crit’ to be an array of strings; invalid types raise.
• Scope: Validate ‘crit’ only against the protected header in JSON serialization.
• Refactor: Add _reject_unprotected_crit(...) to centralize the unprotected check.
• Tests: Add coverage for unprotected ‘crit’ rejection and type enforcement.
• Compatibility: No behavior change for valid tokens; only malformed inputs now fail earlier.
• Note: Does not change recognition/presence logic from the existing fix branch.
• Files changed:
  authlib/authlib/jose/rfc7515/jws.py
  authlib/tests/jose/test_jws.py
• Validation:
  • tests/jose/test_jws.py passes locally.
  • Also All tests ran in tests direcotry 753 passed, 1 skipped in 33.21s.