fix(acme): reject General JWS serialization (#2642)

[Tyagiquamar]

Rejects ACME POST bodies using the General JWS JSON Serialization. RFC 8555 Section 6.2 requires the Flattened JSON Serialization, but parseJWS accepted the General form because go-jose ParseSigned parses both, and a single-signature General JWS also passed the more-than-one-signature check in validateJWS. The middleware now returns a malformed error for bodies carrying a top-level signatures member before parsing.

Fixes #2642.

Verification (all in golang:1.26-bookworm, matching go.mod go 1.26.0):

• gofmt -l acme/api/ -> no output, exit 0
• go vet ./acme/api/ -> exit 0
• go build ./acme/... -> exit 0
• go test ./acme/... -count=1 -> ok all 4 packages (acme, acme/api, acme/db/nosql, acme/wire), exit 0
• New TestHandler_parseJWS/fail/general-jws-serialization case fails without the fix (General JWS accepted) and passes with it.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Tyagiquamar seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Tyagiquamar]

Hi, just following up on this when you get a chance. The branch is up to date and checks are green. If it looks good from your side, it should be ready to merge. Happy to make any changes if needed. Thanks!