TC-458 Fix highest security dependency

[quanqigu]

• Upgrade github.com/tidwall/gjson v1.6.0 to github.com/tidwall/gjson v1.9.3.

• Upgrade github.com/dgrijalva/jwt-go v3.2.0+incompatible to github.com/golang-jwt/jwt/v4 v4.2.0

• The fixed commit of gjson: tidwall/gjson@77a57fd.

• As jwt-go is not maintained, the security issue is fixed in its inherited repo: github.com/golang-jwt/jwt/v4. The fixed PR: Fix issue with MapClaims VerifyAudience []string golang-jwt/jwt#12

CVE-2021-42836
high severity
Vulnerable versions: < 1.9.3
Patched version: 1.9.3
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

CVE-2020-26160
high severity
Vulnerable versions: <= 3.2.0
Patched version: No fix
jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to golang-jwt at version 3.2.1