Support verifying token signature using a JWK

[anakinj]

Description

This tries to implement the idea in #400 by using the alg/crv parameter to resolve the algorithm and use that for verifying the signature.

Checklist

Before the PR can be merged be sure the following are checked:

• There are tests for the fix or feature added/changed
• A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md

[Copilot]

Pull Request Overview

This PR enables token signature verification using a JWK by deriving the correct JWA algorithm from the JWK’s alg or crv parameters.

• Adds verify/sign methods and resolve_algorithm logic in JWK key classes
• Refactors EncodedToken#verify_signature! and valid_signature? to use JWKs and key finders
• Adds corresponding tests, updates examples in README.md, and updates CHANGELOG.md

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
spec/jwt/jwk/rsa_spec.rb	Adds RSA JWK verification tests
spec/jwt/jwk/ec_spec.rb	Adds EC JWK verification tests
spec/jwt/encoded_token_spec.rb	Tests EncodedToken#verify_signature! with a JWK key
spec/integration/readme_examples_spec.rb	Adds readme integration example for JWK verification
lib/jwt/jwk/key_base.rb	Implements verify/sign and resolve_algorithm
lib/jwt/jwk/ec.rb	Overrides resolve_algorithm to handle crv
lib/jwt/jwa/ecdsa.rb	Exposes curve_by_name helper
lib/jwt/jwa.rb	Introduces VerificationContext and verifier factory
lib/jwt/encoded_token.rb	Refactors signature validation to support JWKs
README.md	Adds example for JWK-based verification
CHANGELOG.md	Documents new JWK verification feature

Comments suppressed due to low confidence (3)

spec/jwt/jwk/rsa_spec.rb:120

• The context description is duplicated. Rename this to something like 'when the jwk has an invalid alg value'.

    context 'when the jwk is missing the alg header' do

spec/jwt/jwk/ec_spec.rb:137

• The description says 'returns true' but the expectation checks for false. Update the example description to 'returns false'.

        it 'returns true' do

spec/integration/readme_examples_spec.rb:477

• This example invokes verify! without any assertion. Consider adding an expect { ... }.not_to raise_error or other matcher to ensure the behavior is verified.

      encoded_token.verify!(signature: { key: jwk })