Decode a JWT without verifying it: header (algorithm, key id), payload claims, and issued, not-before and expiry times with whether it is expired now.