base32_decode() is accepting bogus "overlong" and badly padded strings as valid

[Turistu]

All of K5KA, K5KB ... K5KP, K5KA=, K5KB===, K5KM====, etc are accepted as valid encodings of "WT", though only "K5KA====" should be generated by any RFC 4648 compliant base32 encoder.

Example:

for k in K5K{A..P}{,=,===,====}; do oathtool -b "$k"; done

726259

726259

....

and so on for all the 64 combinations.

I happened upon this while using the output from liboath functions as something to compare against while writing my own little implementation of it in _javascript_.

Don't feel obligated to answer this or fix it if you don't think it worth it ;-)