nul-terminate base64-decoded JWT payload before cJSON_Parse

[Kartik (sage-mode-hunter)]

The base64url JWT payload decoded in the OIDC token path is left un-terminated:

• rd_kafka_jwt_b64_decode_payload allocates nbytesdecoded+1 bytes but EVP_DecodeBlock never writes the trailing NUL
• rd_kafka_oidc_token_try_validate hands that buffer straight to cJSON_Parse, which runs strlen() on it
• when the base64 payload length is a multiple of 4 (no "=" padding) EVP_DecodeBlock fills every byte, so the last byte stays uninitialized and strlen reads past the heap allocation (ASAN heap-buffer-overflow read on the token endpoint response)

Terminate after a successful decode, matching rd_base64_decode in rdbase64.c. Added a regression case with an unpadded payload to the existing sub-claim unit test.

[confluent-cla-assistant]

Please sign the Contributor License Agreement here before this PR can be approved.
❌ sage-mode-hunter
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}