feat: validate inbound JWS + update deps and

  Node.js 24.15.0
  Leverage @mojaloop/sdk-standard-components Jws.validator to
  verify
  fspiop-signature headers on inbound
  transactionRequests/authorizations.
  Gated by JWS_VALIDATE (default false). Keys loaded from
  JWS_VERIFICATION_KEYS_DIRECTORY with hot-reload via fs.watch.
  Added HapiRawPayload plugin and stream payload config for
  body parsing.
  Bad signatures return FSPIOP error 3105 / HTTP 400.

  Update Node.js to 24.15.0 (Docker 24.14.1-alpine3.23). Add
  sdk-standard-components 19.18.8. Bump deps: hapi 21.4.8,
  central-services-shared 18.35.7, sinon 21.1.2, ncu 21.0.2.
  Add protobufjs overrides (7.5.5/8.0.1), convict 6.2.5, lodash
   4.18.1,
  axios 1.15.0, and other transitive vulnerability overrides.
  0 vulnerabilities. Add JWS unit tests for coverage.

  Ref: mojaloop/project#4439

Author: gibaros

.nvmrc

@@ -1 +1 @@
-22.22.1
+24.15.0

Dockerfile

@@ -1,5 +1,5 @@
 # Arguments
-ARG NODE_VERSION=22.22.0-alpine3.23
+ARG NODE_VERSION=24.14.1-alpine3.23
 
 # NOTE: Ensure you set NODE_VERSION Build Argument as follows...
 #

config/default.json

@@ -26,6 +26,13 @@
     }
   },
   "SWITCH_ENDPOINT": "http://central-ledger.local:3001",
+  "ENDPOINT_SECURITY": {
+    "JWS": {
+      "JWS_VALIDATE": false,
+      "JWS_VERIFICATION_KEYS_DIRECTORY": "secrets/jwsVerificationKeys",
+      "JWS_VALIDATE_PUT_PARTIES": false
+    }
+  },
   "ERROR_HANDLING": {
     "includeCauseExtension": true,
     "truncateExtensions": true