`azure.cli.core._profile.Profile` sets `"verify_signature": False` when decoding the access token

We received a security concern:

> A critical security flaw in the `azure-cli-core` component was identified, where the JWT decoding process explicitly disables signature verification. This allows attackers to manipulate claims such as Tenant ID and Object ID in tokens, leading to identity spoofing and unauthorized access to cross-tenant data or metadata. The vulnerability resides in `src/azure-cli-core/azure/cli/core/_profile.py`. The `jwt.decode` method is invoked with the option `{"verify_signature": False}`.