CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...