fix(jwt): strip internal _litellm_* claims in global JWKS auth path

Prevents identity spoofing where a token signed by the global JWKS
could inject _litellm_jwt_issuer and other _litellm_* claims that
downstream getters trust. The issuer-scoped path already strips these
via _apply_issuer_claim_mappings; mirror that behavior for the global
fallback path.

Co-authored-by: Yassin Kortam <yassin@berri.ai>

litellm/proxy/auth/handle_jwt.py

@@ -1064,7 +1064,11 @@ class JWTHandler:
                     issuer=decode_kwargs["issuer"],
                     options=decode_kwargs["options"],
                 )
-                return payload
+                return {
+                    k: v
+                    for k, v in payload.items()
+                    if k not in self.LITELLM_INTERNAL_CLAIMS
+                }
 
             except jwt.ExpiredSignatureError:
                 # the token is expired, do something to refresh it