with `spring-security-oatuh2-jose-7.1.0` a `jwt` with `loa` value `null` always returns an error

[kostja86]

Describe the bug

With spring-security-oauth2-jose-7.0.5 it is possible to have a loa with value null in a given jwt. For machine to machine communication, it makes no sense to set the loa, as no real user is present.

Implementation with spring-security-oauth2-jose-7.0.5:

	@Override
	public OAuth2TokenValidatorResult validate(Jwt token) {
		Assert.notNull(token, "token cannot be null");
		T claimValue = token.getClaim(this.claim);
		if (this.test.test(claimValue)) {
			return OAuth2TokenValidatorResult.success();
		}
		this.logger.debug(this.error.getDescription());
		return OAuth2TokenValidatorResult.failure(this.error);
	}

A loa with null value is forwarded to the configured claim validator, e.g. something like..

    @Bean
    JwtClaimValidator<String> loaClaimValidator() {
        return new JwtClaimValidator<>("loa", new Predicate<String>() {
            @Override
            public boolean test(final String loaClaimValue) {      
                return loaClaimValue == null;
            }
        });
    }

..configured within the WebSecurityConfig.

Implementation with spring-security-oauth2-jose-7.1.0:

	@Override
	public OAuth2TokenValidatorResult validate(Jwt token) {
		Assert.notNull(token, "token cannot be null");
		T claimValue = token.getClaim(this.claim);
		if (claimValue != null) {
			if (this.test.test(claimValue)) {
				return OAuth2TokenValidatorResult.success();
			}
		}
		this.logger.debug(this.error.getDescription());
		return OAuth2TokenValidatorResult.failure(this.error);
	}

A loa with value null returns always an error, the custom validator is ignored.

To Reproduce

1. Create a jwt without a value for loa.
2. Perform a request against an endpoint that validates the jwt.
3. The custom provided JwtClaimValidator is NOT called.
4. OAuth2TokenValidatorResult.failure(this.error) is returned.

Expected behavior

1. Create a jwt without a value for loa.
2. Perform a request against an endpoint that validates the jwt.
3. The custom provided JwtClaimValidator is called.
4. OAuth2TokenValidatorResult.success() validator is returned, if custom validator returns true.