Permitting multiple JWT schemes

### Runtime

Node.js

### Runtime version

18.18.2

### Module version

3.2.0

### Used with

Hapi 21

### Any other relevant information

_No response_

### What problem are you trying to solve?

We would like to have a Hapi route that allows two different sets of JWT tokens (with different issuers, audiences, and schemes). I thought that I could configure a route [strategies](https://hapi.dev/api/?v=21.3.2#route.options.auth.strategies) for this; however, @hapi/jwt's errors always include error messages, which causes Hapi to reject the request ([see here](https://hapi.dev/api/?v=21.3.2#authentication-scheme)) rather than continue to the next scheme.

### Do you have a new or modified API suggestion to solve the problem?

If I understand correctly, @hapi/jwt currently validates the timestamp, then audience, then issuer, then other token values, then the signature:

- https://github.com/hapijs/jwt/blob/v3.2.0/lib/plugin.js#L187
- https://github.com/hapijs/jwt/blob/v3.2.0/lib/token.js#L146

It seems to me that this is out of order and that a better approach would be the following:

1. If an issuer is configured, then check the issuer. If the issuer does not match, then the current @hapi/jwt scheme is not responsible for this JWT and fails with a no-message unauthorized result so that Hapi continues authentication with the next configured strategy.
2. Validate the signature, to avoid leaking information about valid audiences/etc. if there's no valid signature.
3. Validate the remaining payload.

If this is too big a change (e.g., due to backward compatibility concerns or processing costs of retrieving and validating signatures), then could the issuer check be moved first, and add some sort of `ignoreUnknownIssuer` option be added to allow a no-message unauthorized result if the issuer doesn't match?