v0.4.0 harden jwt, scram, credential handling

.github/workflows/test.yml

@@ -0,0 +1,27 @@
+name: test
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: '1.26.x'
+      - run: go vet ./...
+      - run: go test -race -count=1 ./...
+      - name: Bounded fuzz smoke tests
+        env:
+          GOMAXPROCS: '2'
+        run: |
+          set -eu
+          for target in FuzzParsePHC FuzzVerifyPassword FuzzImportCredential FuzzValidateHS256Token FuzzParseBearerToken FuzzScramServerMessages FuzzScramClientMessages; do
+            go test -run '^$' -fuzz "^${target}$" -fuzztime=10s -parallel=2
+          done