re #96 migrate JWT adapter to lcobucci/jwt 5.x + fix content negotiation

[tonydspaniard]

Summary

Part of the #96 burn-down. The baseline entries that looked like "optional-dep class-not-found" were actually real API-version-mismatch bugs: the Altair\Http\Jwt\* adapters targeted the lcobucci/jwt 3.x API while the framework requires ^5.3, so the JWT feature could not run against the installed library. Fixed properly (no ignoreErrors).

JWT — migrated to lcobucci/jwt 5.x

• LcobucciTokenGenerator / LcobucciTokenParser now derive a fresh Lcobucci\JWT\Configuration from the framework TokenConfigurationInterface instead of injecting shared Builder/Parser primitives. (The v5 builder is immutable; the old shared-builder loop also silently discarded withClaim() results — a latent bug.)
• Parser now performs full validation: signature (SignedWith, algorithm fixed to the configured signer → alg=none/algorithm-confusion rejected), issuer (IssuedBy), and time window (LooseValidAt). The old validateToken() was dead code, so token expiry was never enforced — that security gap is now closed and covered by tests.
• Added PSR-20 Altair\Http\Jwt\SystemClock (injectable; frozen in tests for deterministic expiry) and declared psr/clock as a direct dependency.

Security hardening (from independent security review)

• Reject the unconfigured TOKEN_PUBLIC_KEY placeholder at runtime (fail fast) instead of silently issuing unverifiable tokens.
• Stop interpolating the raw token into parse-failure exception messages (log-injection / oracle risk).
• Finding 4 (stable issuer): iss is now a configurable TOKEN_ISSUER (required, fail-fast) on TokenConfigurationInterface rather than the per-request URI — a token is no longer valid only at the exact endpoint that minted it. The generator/parser no longer depend on ServerRequest.
• Finding 5 (audience): optional TOKEN_AUDIENCE — when set, the generator adds permittedFor() and the parser asserts PermittedFor; absent audience keeps the single-service default.

Content negotiation

• FormatNegotiator: narrow Negotiator::getBest() (typed as the empty AcceptHeader marker interface) to BaseAccept before getValue(); and flatten mime priorities with array_merge(...) — the previous call_user_func('array_merge', …) passed an array-of-arrays as one argument, so header negotiation never worked.

PHPStan

• Regenerated phpstan-baseline.neon: 14 Lcobucci/Negotiation findings drop out, none added. 65 → 51 errors.

Test plan

• composer cs — clean
• composer stan — [OK] No errors
• vendor/bin/rector process --dry-run (full codebase) — clean
• composer test — JWT round-trip + tampered/foreign-key/expired/wrong-issuer/malformed rejection + audience accept/reject + Accept-header negotiation all pass; only pre-existing local MongoSessionHandlerTest env errors (CI loads ext-mongodb)