Co-authored-by: Christian Banse <[email protected]>

* Implement a BearerExtractor

This is a rather common extractor; it extracts the JWT from the HTTP
Authorization header, expecting it to include the "Bearer " prefix.

This patterns is rather common and this snippet is repeated in enough
applications that it's probably best to just include it upstream and
allow reusing it.

* Ignore case-sensitivity for "Bearer"

* Bump matrix to support latest go version (go1.19)

* Fix comment

Fixes #223

By default base64 decoder works in non-strict mode which
allows tweaking signatures having padding without failing validation.

This creates a potential problem if application treats token value as an identifier.

For example ES256 signature has length of 64 bytes and two padding symbols (stripped by default).
Therefore its base64-encoded value can only end with A, Q, g and w.
In non-strict mode last symbol could be tweaked resulting in 16 distinct
token values having the same signature and passing validation.

This change adds backward-compatible global config variable DecodeStrict
(similar to existing DecodePaddingAllowed) that enables strict base64 decoder mode.

See also golang/go#15656.

Signed-off-by: Alexander Yastrebov <[email protected]>

* Initial draft of adding text to ParseWithClaims

* Adjusted example and referring to the example in Parse functions

* Backporting logic from v5

* Added a test