Handle JWT::DecodeError in ConanToken instead of the API class

Update `find_personal_access_token_from_conan_jwt` finder to return nil
and let `find_personal_access_token` to call `unauthorized!` if no
access token is found.

ee/lib/api/conan_packages.rb

@@ -52,10 +52,9 @@ module API
         return unless jwt
 
         token = ::Gitlab::ConanToken.decode(jwt)
+        return unless token&.personal_access_token_id && token&.user_id
 
         PersonalAccessToken.find_by_id_and_user_id(token.personal_access_token_id, token.user_id)
-      rescue JWT::DecodeError
-        unauthorized!
       end
 
       def find_personal_access_token_from_conan_http_basic_auth

ee/lib/gitlab/conan_token.rb

@@ -15,6 +15,7 @@ module Gitlab
         payload = JSONWebToken::HMACToken.decode(jwt, secret).first
 
         new(personal_access_token_id: payload['pat'], user_id: payload['u'])
+      rescue JWT::DecodeError
       end
 
       def secret

ee/spec/lib/gitlab/conan_token_spec.rb

@@ -44,6 +44,10 @@ describe Gitlab::ConanToken do
       expect(token.personal_access_token_id).to eq(123)
       expect(token.user_id).to eq(456)
     end
+
+    it 'returns nil for invalid JWT' do
+      expect(described_class.decode('invalid-jwt')).to be_nil
+    end
   end
 
   describe '#to_jwt' do