fix(sdk): verify JWT claims before returning them

[omercnet]

Summary

• make getClaims return only claims from validateJWT, so JWKS kid lookup and RSA signature verification run first
• reject expired signed tokens before returning claims
• make the unverified token parser internal-only
• add regression tests for forged RS256 payload claims and expired signed claims, and update README wording

Verification

• docker run --rm -v "$PWD":/app -w /app composer:2 php -l src/SDK/Token/Extractor.php
• docker run --rm -v "$PWD":/app -w /app composer:2 php -l src/tests/DescopeSDKTest.php
• docker run --rm -v "$PWD":/app -w /app composer:2 composer test
• manual QA: local JWKS mock + public DescopeSDK::getClaims accepted a signed token, rejected an expired signed token, and rejected a forged token with TokenException

[shuni-bot-dev]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot-dev]

🐕 Suggested Reviewers

The review assignment prioritizes recent contributors who have worked on the affected files, with a focus on those demonstrating breadth across the changed areas. Since only one contributor has recent activity on all relevant files, they are recommended for thorough review.

Reviewer	Reason
gaokevin1	Recently contributed 24 commits covering all changed files, including tests and the main extraction logic, making them well-versed in these areas.
gaokevin1	Has recent activity on both the source code and tests, ensuring familiarity with the recent modifications and validation processes.
gaokevin1	Their recent contributions span across the key files involved in this PR, providing comprehensive coverage from implementation to testing.
gaokevin1	Consistent recent activity on the affected files indicates strong knowledge of the codebase areas impacted by this update.
gaokevin1	Extensive recent involvement with the files ensures they are well-positioned to review both logic changes and test updates efficiently.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot-dev]

🐕 Shuni's Review

Makes getClaims run full JWKS signature verification (via validateJWT) instead of returning the unverified payload, and locks down the raw parser. Solid security fix — good bones!

Sniffed out 1 issue:

• 1 🟢 LOW: getClaims verifies signature/issuer but not expiration

Retry logic, privatizing parseToken (no external callers), and the forged-token regression test all check out. Woof!