fix(multiplayer): reject typed claim coercion

Game/scripts/match_net.gd

@@ -335,7 +335,13 @@ func _valid_join_authorisation(token: String) -> bool:
 	var claims = envelope["Authorisation"]
 	if not claims is Dictionary:
 		return false
-	if str(claims.get("PlayerID", "")).is_empty():
+	for string_claim in ["MatchID", "ServerID", "PlayerID", "SteamID", "Protocol", "ExpiresAt"]:
+		if not claims.has(string_claim) or not claims[string_claim] is String or String(claims[string_claim]).is_empty():
+			return false
+	for integer_claim in ["Slot", "Team", "Generation"]:
+		if not claims.has(integer_claim) or not _valid_integer_claim(claims[integer_claim]):
+			return false
+	if not envelope["Signature"] is String or String(envelope["Signature"]).is_empty():
 		return false
 	var claimed_team := int(claims.get("Team", -1))
 	var claimed_slot := int(claims.get("Slot", -1))
@@ -374,6 +380,14 @@ func _valid_join_authorisation(token: String) -> bool:
 		and expiry > Time.get_unix_time_from_system()
 
 
+static func _valid_integer_claim(value: Variant) -> bool:
+	if value is int:
+		return int(value) >= 0
+	if value is float:
+		return is_finite(float(value)) and float(value) >= 0.0 and float(value) == floor(float(value))
+	return false
+
+
 func _join_identity(token: String) -> String:
 	if token.is_empty():
 		return ""