Moderate CVE in transitive dependency gopkg.in/square/go-jose.v2

#### Behavior

`go.sum` has a dependency on `gopkg.in/square/go-jose.v2 v2.4.1`
https://github.com/apache/pulsar-client-go/blob/4e71a47a4f6174f883905e740ba35f2498494ed1/go.sum#L723

There is an associated CVE https://avd.aquasec.com/nvd/2024/cve-2024-28180/

However that dependency is now archived https://github.com/square/go-jose/tree/master

CVE documentation says `This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.`
but that requires a different path https://github.com/go-jose/go-jose

The dependency seems to come from here

```
github.com/apache/pulsar-client-go/pulsar
github.com/apache/pulsar-client-go/pulsar/auth
github.com/AthenZ/athenz/libs/go/zmssvctoken
github.com/AthenZ/athenz/libs/go/athenzutils
gopkg.in/square/go-jose.v2/jwt
```

Start with go.sum at the cited dependency entry and trace the dependency chain through pulsar/auth and the AthenZ packages. Read the linked CVE and archived go-jose information, then determine the supported dependency path and affected module references. Done means the vulnerable transitive dependency is no longer present and the dependency state is verified.

Written by the indexing model from the issue text.