BUG/MINOR: jwe: reject non-empty encrypted keys with "dir" and "ECDH-ES"

BUG/MINOR: jwe: reject non-empty encrypted keys with "dir" and "ECDH-ES"

RFC 7516 section 5.2 step 10 requires that when direct encryption ("dir")
or direct key agreement ("ECDH-ES") are used, the JWE Encrypted Key part
of the token is empty. The jwt_decrypt_jwk() converter with "dir", and
both jwt_decrypt_jwk() and jwt_decrypt_cert() with "ECDH-ES", silently
ignore this part.

This can be reproduced by inserting any base64url string (e.g. "AAAA")
between the first two dots of a "dir" or "ECDH-ES" token: the converters
still return the decrypted contents.

Let's reject the token when the encrypted key is not empty for these
algorithms.

This fix must be backported to 3.4.