Separate test deps from v2 module

[wallyqs]

Currently v2 go.mod depends on the v1 version (which includes a CVE), this transitive dependency makes vulnerability check tools report v2 as including the CVE, even though v1 is only being used for testing purposes. This separates the test dependencies in the go.mod files so that this does not happen.

# Test without external dependencies
go test github.com/nats-io/jwt/v2 -v

# Tests with external dependencies (v1 dep in this case)
go test -modfile=go_test.mod github.com/nats-io/jwt/v2/test -v

Fixes #156

[aricart]

LGTM - but would like @kozlovic give an LGTM as well as he does the JWT release.

[kozlovic]

LGTM. I posted also a comment in associated issue that we could make a release of the v1 because the cve issue was fixed in both code base. But I am not super comfortable doing a v1 release..

[wallyqs]

Agree, maybe it can be done too if we branch out from latest v1 release, apply the fix from (#149) and then tag a v1 release that has the fix.

[matthiashanel]

LGTM

[kozlovic]

@wallyqs The fix is already in. We would not have to actually branch anything. If we were to update the version in the v1 (root) dir to say 1.3.0, and push a tag v1.3.0 then release, it would be totally possible I think. But again, I am not sure I would want to do that..

[wallyqs]

@kozlovic I see now, thanks for the clarification.