Decode JWT private claims

- Add a basic test around `jws.Decode`
- Decode private claims when decoding a claim set

Note that this puts all claims that are not set on `ClaimSet` into `PrivateClaims`. This is not strictly correct as there are a number of registered claims that are not used by this library. However, it seemed like the least confusing thing to do.
We should be good to go with Errorf instead all through this file.