feat: add configurable HTTP request timeouts

[stlasalle]

What has changed

• Added configurable authentication, management, and connection timeouts, plus optional Guzzle client injection.
• Applied request timeouts as an end-to-end retry budget and bounded JWK requests.

Why has it changed

Slow or unresponsive network calls should not hold PHP workers indefinitely. Separate authentication and management timeouts allow latency-sensitive authentication calls to fail promptly while preserving a longer budget for management operations.

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

The review assignment strategy focuses on breadth of coverage across key files, with selection favoring contributors who have significant and varied contributions to ensure thorough review of the changes.

Reviewer	Reason
gaokevin1	gaokevin1 has the most commits and extensive file coverage, including core SDK files and configuration, making them well-suited to review the overall integration and impact of the timeout features.
omercnet	omercnet has significant contributions across multiple files, including core files and tests, providing a good perspective on both implementation and testing aspects.
dorsha	dorsha has contributed across several files, including core SDK code and documentation, and can provide insights on the implementation details and usability.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[gaokevin1]

Superseded by #131, which implements the same capability with a lighter single-knob design (requestTimeout) matching the Go and Python SDKs, and fixes the injected-client timeout-override behavior. Closing in favor of #131.