Kuma vulnerabilities

When kuma-dp is started against an HTTPS control plane without a CA certificate, TLS peer verification is disabled and the dataplane authentication token is sent over that unverified connection.

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.