add hmac verification for aes cbc

[cormacdalton]

PR checklist

• An issue/feature request has been created for this PR
• Pull Request title clearly describes the work in the pull request and the Pull Request description provides details about how to validate the work. Missing information here may result in a delayed response.
• File the PR against the master branch
• The code in this PR is covered by unit tests

Description

This PR implements HMAC authentication tag verification for AES-CBC encrypted payloads (A128CBC-HS256) in JWE, providing enhanced security and compliance with RFC 7516 (JSON Web Encryption) specification. The feature is opt-in and disabled by default to maintain backward compatibility with existing systems.

[joseph-neeraj]

The secretKey is incorrect here I think, as it has already been sliced to be the encryption key. So the mac should be extracted and passed here. Something like:

Suggested change

	secretKey = secretKey.slice(16, 32);
	gcmMode = false;
	if(this.enableHmacVerification) {
	verifyCbcHmac(jweTokenParts[0], iv, encryptedText, authTag, secretKey);
	const macKey = secretKey.slice(0, 16);
	secretKey = secretKey.slice(16, 32);
	gcmMode = false;
	if(this.enableHmacVerification) {
	verifyCbcHmac(jweTokenParts[0], iv, encryptedText, authTag, macKey);