Ensure Base64URL decoding is implemented correctly

JWT data is "Base64 URL encoded", which is RFC4648, section 5
"Base 64 Encoding with URL and Filename Safe Alphabet".  This
differs from regular Base64 in characters 62 and 63, and
any trailing padding characters are omitted.

Add a helper function to perform the transformation and restore
padding before passing it to PHP's base64_decode.
Add support for verifying RSA signatures

This adds support for verifying RSA signatures on JWTs.  It
uses phpseclib's crypto implementation.  If phpseclib is
unavailable, it will print a warning, and will not attempt
to verify signatures.