PyJWT regression: decode() mutates caller's options dict and bypasses claims checks

PyJWT 2.11.0–2.13.0 contains regression CVE-2026-103001: when verify_signature is False, decode() writes seven verify_* keys directly into the caller-supplied options dict. Reusing that object with verify_signature=True then skips expiry, audience and issuer checks. The bug was fixed in 2022 but reintroduced by refactor PR 1045 in March 2025.

• Affects PyJWT 2.11.0–2.13.0; no patched version at publication
• decode() writes 7 verify_* keys into the caller's dict without copying
• First reported in 2021, fixed in 2022, reintroduced in March 2025
• Only claims checks are bypassed; signature verification is unaffected