build(deps): bump github.com/nats-io/nats-server/v2

Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.10.10 to 2.10.12.
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/.goreleaser.yml)
- [Commits](https://github.com/nats-io/nats-server/compare/v2.10.10...v2.10.12)

---
updated-dependencies:
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/nats-io/jwt/v2/account_claims.go

@@ -17,6 +17,7 @@ package jwt
 
 import (
 	"errors"
+	"fmt"
 	"sort"
 	"time"
 
@@ -174,7 +175,7 @@ func (a *Account) AddMapping(sub Subject, to ...WeightedMapping) {
 // holder of the private key can decrypt. The auth service can also optionally encrypt the response back to the server using it's
 // publick xkey which will be in the authorization request.
 type ExternalAuthorization struct {
-	AuthUsers       StringList `json:"auth_users"`
+	AuthUsers       StringList `json:"auth_users,omitempty"`
 	AllowedAccounts StringList `json:"allowed_accounts,omitempty"`
 	XKey            string     `json:"xkey,omitempty"`
 }
@@ -229,10 +230,25 @@ type Account struct {
 	DefaultPermissions Permissions           `json:"default_permissions,omitempty"`
 	Mappings           Mapping               `json:"mappings,omitempty"`
 	Authorization      ExternalAuthorization `json:"authorization,omitempty"`
+	Trace              *MsgTrace             `json:"trace,omitempty"`
 	Info
 	GenericFields
 }
 
+// MsgTrace holds distributed message tracing configuration
+type MsgTrace struct {
+	// Destination is the subject the server will send message traces to
+	// if the inbound message contains the "traceparent" header and has
+	// its sampled field indicating that the trace should be triggered.
+	Destination Subject `json:"dest,omitempty"`
+	// Sampling is used to set the probability sampling, that is, the
+	// server will get a random number between 1 and 100 and trigger
+	// the trace if the number is lower than this Sampling value.
+	// The valid range is [1..100]. If the value is not set Validate()
+	// will set the value to 100.
+	Sampling int `json:"sampling,omitempty"`
+}
+
 // Validate checks if the account is valid, based on the wrapper
 func (a *Account) Validate(acct *AccountClaims, vr *ValidationResults) {
 	a.Imports.Validate(acct.Subject, vr)
@@ -241,6 +257,21 @@ func (a *Account) Validate(acct *AccountClaims, vr *ValidationResults) {
 	a.DefaultPermissions.Validate(vr)
 	a.Mappings.Validate(vr)
 	a.Authorization.Validate(vr)
+	if a.Trace != nil {
+		tvr := CreateValidationResults()
+		a.Trace.Destination.Validate(tvr)
+		if !tvr.IsEmpty() {
+			vr.AddError(fmt.Sprintf("the account Trace.Destination %s", tvr.Issues[0].Description))
+		}
+		if a.Trace.Destination.HasWildCards() {
+			vr.AddError("the account Trace.Destination subject %q is not a valid publish subject", a.Trace.Destination)
+		}
+		if a.Trace.Sampling < 0 || a.Trace.Sampling > 100 {
+			vr.AddError("the account Trace.Sampling value '%d' is not valid, should be in the range [1..100]", a.Trace.Sampling)
+		} else if a.Trace.Sampling == 0 {
+			a.Trace.Sampling = 100
+		}
+	}
 
 	if !a.Limits.IsEmpty() && a.Limits.Imports >= 0 && int64(len(a.Imports)) > a.Limits.Imports {
 		vr.AddError("the account contains more imports than allowed by the operator")

vendor/github.com/nats-io/jwt/v2/exports.go

@@ -119,6 +119,7 @@ type Export struct {
 	Latency              *ServiceLatency `json:"service_latency,omitempty"`
 	AccountTokenPosition uint            `json:"account_token_position,omitempty"`
 	Advertise            bool            `json:"advertise,omitempty"`
+	AllowTrace           bool            `json:"allow_trace,omitempty"`
 	Info
 }
 
@@ -160,8 +161,13 @@ func (e *Export) Validate(vr *ValidationResults) {
 	if e.IsService() && !e.IsSingleResponse() && !e.IsChunkedResponse() && !e.IsStreamResponse() {
 		vr.AddError("invalid response type for service: %q", e.ResponseType)
 	}
-	if e.IsStream() && e.ResponseType != "" {
-		vr.AddError("invalid response type for stream: %q", e.ResponseType)
+	if e.IsStream() {
+		if e.ResponseType != "" {
+			vr.AddError("invalid response type for stream: %q", e.ResponseType)
+		}
+		if e.AllowTrace {
+			vr.AddError("AllowTrace only valid for service export")
+		}
 	}
 	if e.Latency != nil {
 		if !e.IsService() {

vendor/github.com/nats-io/jwt/v2/imports.go

@@ -40,6 +40,7 @@ type Import struct {
 	LocalSubject RenamingSubject `json:"local_subject,omitempty"`
 	Type         ExportType      `json:"type,omitempty"`
 	Share        bool            `json:"share,omitempty"`
+	AllowTrace   bool            `json:"allow_trace,omitempty"`
 }
 
 // IsService returns true if the import is of type service
@@ -66,6 +67,9 @@ func (i *Import) Validate(actPubKey string, vr *ValidationResults) {
 	if !i.IsService() && !i.IsStream() {
 		vr.AddError("invalid import type: %q", i.Type)
 	}
+	if i.IsService() && i.AllowTrace {
+		vr.AddError("AllowTrace only valid for stream import")
+	}
 
 	if i.Account == "" {
 		vr.AddError("account to import from is not specified")

vendor/github.com/nats-io/jwt/v2/types.go

@@ -177,10 +177,18 @@ func (s Subject) Validate(vr *ValidationResults) {
 	v := string(s)
 	if v == "" {
 		vr.AddError("subject cannot be empty")
+		// No other checks after that make sense
+		return
 	}
 	if strings.Contains(v, " ") {
 		vr.AddError("subject %q cannot have spaces", v)
 	}
+	if v[0] == '.' || v[len(v)-1] == '.' {
+		vr.AddError("subject %q cannot start or end with a `.`", v)
+	}
+	if strings.Contains(v, "..") {
+		vr.AddError("subject %q cannot contain consecutive `.`", v)
+	}
 }
 
 func (s Subject) countTokenWildcards() int {