Fix #1000: Prevent callback from being called twice on payload claim conflict

[cobyfrombrooklyn-bot]

When jwt.sign() is called with a callback and the payload has a claim that conflicts with an option (e.g., payload.iss + options.issuer), the callback was invoked twice: once with the error and once with a successfully signed token.

Root Cause

The options-to-payload mapping at line 217 used forEach(). Inside the forEach callback, return failure() only returns from the forEach callback function, not from the outer sign function. So after the error callback fires, the forEach continues processing remaining keys, and then execution falls through to jws.createSign() which calls the callback again with a token.

Fix

Replaced forEach with a for loop so that return failure() properly exits the sign function, preventing the signing logic from executing after an error.

Test

Added test in async_sign.tests.js: "should call the callback only once with an error". It:

1. Signs a token with conflicting iss in payload and issuer in options
2. Counts callback invocations
3. Asserts callback is called exactly once, with an error
4. Uses setTimeout to verify no second invocation occurs

Without the fix, the callback fires twice (error + token). With the fix, it fires once (error only).

Full test suite: 512 passing, 1 pending. Tested locally on macOS ARM (Apple Silicon).

Fixes #1000