WARNING: This function does NOT perform signature verification.
It strictly decodes the payload for inspection. To ensure the integrity
and authenticity of the token, you MUST verify the signature using
a trusted library (e.g., jsonwebtoken) and your secret/public key.
Throws
If the token is malformed or the payload cannot be parsed
Decodes a JWT payload without verifying its signature.