fix(security): refresh roave guard (2026-05-22 -> 2026-08-01) via web-token/jwt-library (#2301)

The lockfile pinned roave/security-advisories to a 2026-05-22 commit, freezing
its conflict rules — and all protection against CVEs published since — at that date.

Refreshing it was blocked by an aliasing artifact: roave conflicts with
web-token/jwt-experimental <4.1.7, and web-token/jwt-framework 3.4.10 replaces
jwt-experimental at self.version, so the patched 3.4.10 monolith trips a rule whose
range was written without the <3.4.10 carve-out the same advisory carries against
jwt-framework itself. Every upstream web-token advisory is fixed in 3.4.10, and
composer audit --locked reports 0 here — this was never a live vulnerability.

Rather than force a major upgrade to ^4, depend directly on the split package we
actually use:

  -  "web-token/jwt-framework": "^3"
  +  "web-token/jwt-library": "^3.4.10"

Same version, 3.4.10. All 24 distinct Jose\\Component classes used across
openregister, doriath and openconnector were checked to resolve inside the
jwt-library 3.4.10 dist (with a positive control); all 24 resolve. No usage of
Jose\\Bundle, JoseFramework or Jose\\Experimental anywhere in lib/ or tests/.

This reduces attack surface: jwt-experimental, the package that genuinely carries
an unbounded advisory range, is no longer installed.

composer audit --locked: 0 advisories before -> 0 after.

Author: rubenvdlinde

composer.json

@@ -119,7 +119,7 @@
 		"symfony/yaml": "^6.4 || ^7.0",
 		"theodo-group/llphant": "^0.9.3",
 		"twig/twig": "^3.27.0",
-		"web-token/jwt-framework": "^3",
+		"web-token/jwt-library": "^3.4.10",
 		"webonyx/graphql-php": "^15.0",
 		"zbateson/mail-mime-parser": "^3.0"
 	},