fix off-by-one buffer over-read in mod_autht_jwt check_token

[arshsmith1]

check_token in mod_autht_jwt.c starts the claim-name sanitizing loop at j = sizeof(AUTHT_PREFIX), one byte past the length of the "TOKEN_" prefix, so the first character of every claim name is left unsanitized and a token whose claims contain an empty-string key ({"":"..."}) makes key equal to "TOKEN_" in a 7-byte buffer where the loop then reads key[7], one past the allocation. Initialize j to sizeof(AUTHT_PREFIX) - 1, matching the AUTHN_PREFIX handling already used in mod_authn_dbd and mod_authnz_ldap.