[BUG] Sign plugin can return 500 for malformed signature input

### Current Behavior

The Sign plugin has malformed-input paths that can throw unchecked exceptions instead of returning the normal signature verification failure response.

Examples in current `origin/master`:

- `VersionTwoExtractor.extract()` Base64-decodes and JSON-parses the first token segment without handling bad input.
- `ComposableSignService.verifyExpires()` only checks that the timestamp is nonblank before calling `Long.parseLong(...)`.
- In the no-body verification path, `SignPlugin.doExecute()` does not convert these unchecked exceptions into `SIGN_IS_NOT_PASS`.

Malformed signature headers or nonnumeric timestamps can therefore escape as server errors instead of clean verification failures.

### Expected Behavior

Invalid or malformed sign parameters should return the configured sign verification failure response, not an uncaught runtime exception.

### Steps to Reproduce

1. Enable the Sign plugin on a route.
2. Send a request with malformed `ShenYu-Authorization` / `Authorization` sign data, or with a nonnumeric timestamp in the decoded sign parameters.
3. The plugin can throw during extraction or expiry verification instead of returning `SIGN_IS_NOT_PASS`.

### Code Location

- `shenyu-plugin/shenyu-plugin-security/shenyu-plugin-sign/src/main/java/org/apache/shenyu/plugin/sign/extractor/VersionTwoExtractor.java`
- `shenyu-plugin/shenyu-plugin-security/shenyu-plugin-sign/src/main/java/org/apache/shenyu/plugin/sign/service/ComposableSignService.java`
- `shenyu-plugin/shenyu-plugin-security/shenyu-plugin-sign/src/main/java/org/apache/shenyu/plugin/sign/SignPlugin.java`

Start with VersionTwoExtractor.java and ComposableSignService.java to trace malformed token decoding and timestamp parsing, then inspect SignPlugin.java's no-body verification path. Reproduce malformed signature and nonnumeric timestamp requests with the Sign plugin enabled, and confirm both return the configured SIGN_IS_NOT_PASS response rather than an uncaught exception or server error.

Written by the indexing model from the issue text.