Validate the GAT token type from the payload instead of the JWT header

[minhtule]

Summary

The Gateway rejects a GAT whose JWT header typ is not GAT. RFC 7519 reserves that header for the token's media type, so it should be JWT. The Controller cannot correct the header while deployed Gateways validate it.

Requirements

• The Gateway validates the token type from the typ payload claim, which the Controller sets to GAT.
• The Gateway no longer reads the JWT header typ, so the Controller can correct it to JWT.

This depends on a Controller that emits the payload claim, so it must not ship before that change is in production.

[linear-code]

OSS-167