fix(auth): improve JWT and GitHub OIDC token handling (#2832)

Signed-off-by: Matías Insaurralde <matias@chainloop.dev>

Author: matiasinsaurralde

pkg/attestation/crafter/runners/oidc/github.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2025 The Chainloop Authors.
+// Copyright 2025-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -173,6 +173,7 @@ func (c *GitHubOIDCClient) Token(ctx context.Context) (any, error) {
 	if err != nil {
 		return nil, fmt.Errorf("error decoding token: %w", err)
 	}
+	token.RawToken = tokenPayload
 
 	if err := c.verifyClaims(token); err != nil {
 		return nil, fmt.Errorf("error verifying claims: %w", err)

pkg/middlewares/http/jwt.go

@@ -84,6 +84,10 @@ func AuthFromAuthorizationHeader(keyFunc jwt.Keyfunc, claimsFunc ClaimsFunc, sig
 func verifyAndMarshalJWT(token string, keyFunc jwt.Keyfunc, claimsFunc ClaimsFunc, signingMethod jwt.SigningMethod) (*jwt.Claims, error) {
 	var tokenInfo *jwt.Token
 
+	if token == "" {
+		return nil, jwtMiddleware.ErrTokenInvalid
+	}
+
 	tokenInfo, err := jwt.ParseWithClaims(token, claimsFunc(), keyFunc)
 	if err != nil {
 		var ve *jwt.ValidationError