Decode a JWT header and payload (no signature check) and flag alg none, expiry, nbf and missing claims.