JWS: remove irrelevant TODO on invalid crit fields

JWS defines that recipients MAY reject a JWS if the critical list
contains any Header Parameter names defined by JWS or JWA.  JWA
doesn't define any additional header parameters for JWS so remove
the TODO about that.
JWS: reject empty crit list
JWS: fix JSON serialization decoding
obey hlint

I've added a pre-commit hook to run hlint now, so hopefully this
won't happen much anymore -_-