PYSEC-2026-4355: Authlib algorithm-confusion vulnerability

In Authlib versions from 1.3.1 up to before 1.9.0, a prefixed PEM or certificate key can bypass the check intended to prevent an asymmetric public key from being used as an HMAC secret. When the documented mixed algorithm registry is used, an unauthenticated attacker who knows the same public key can forge HS256 tokens with arbitrary identity or authorization claims. The issue is fixed in version 1.9.0.