fix(encryption): allow a sender key with a static key agreement

[Spomky]

Closes #680.

JWEBuilder::withSenderKey() could not be used with a direct static key agreement such as ECDH-SS, and
the sender key was dropped even when the mode check was passed.

What was wrong

• withSenderKey() derived the key management mode from the shared headers and checked the key against it.
  Called before addRecipient() it threw Invalid content encryption algorithm, because checkKey()
  needs the content encryption algorithm and only addRecipient() sets it. Called after it threw
  Foreign key management mode forbidden., because agree + agree is not a supported combination.
• determineCEK() read the sender key from $this->recipients[0]['sender_key'], an entry that is never
  written anywhere, so a direct key agreement always reached ECDHSS::getAgreementKey() with no sender key
  and threw The sender key shall be set. processRecipient() did not have the problem thanks to its
  ?? $this->senderKey fallback, which is why ECDH-SS+A128KW and friends worked.
• JWEDecrypter::decryptUsingKey() passed $senderKey as the fourth argument of decryptUsingKeySet(),
  which is the &$jwk output parameter. The sender key never reached the algorithm, so a token built
  with a static key agreement could not be decrypted back through that method. Found while writing the
  round-trip test: without this one, the builder fix produces tokens nothing can read.

What changed

• withSenderKey() only stores the key. The sender key does not add a recipient, so it must not go through
  the key management mode compatibility matrix.
• The key is verified by build() (new checkSenderKey()), against the key encryption algorithm of each
  recipient, where the content encryption algorithm is known whatever the call order is. This also settles
  the TODO that sat on top of the method.
• determineCEK() falls back to $this->senderKey like processRecipient() does.
• decryptUsingKey() passes the sender key in the right position.

Tests

tests/Component/Encryption/JWEBuilderSenderKeyTest.php — withSenderKey() had no coverage at all and no
test exercised ECDH-SS. Six cases: sender key set before and after addRecipient() with an ECDH-SS
round trip, missing sender key, ECDH-SS+A128KW, ECDH-ES where the sender key replaces the ephemeral key
(the published epk is the given key), and the deferred key check at build time. Five of the six fail on
4.2.x.

Note for the reviewer: on the decryption side of a static key agreement the roles are swapped — the public
key of the sender is the key of the key set and the private key of the recipient is the sender key, since
epk is not part of the token. That is the existing convention of ECDHSSAESKW and its tests, not
something introduced here.

Checks

Full test suite (874 tests), ECS and PHPStan are green. One PHPStan baseline entry goes from count: 1 to
2 (Cannot access offset 'key_encryption_algorithm' on mixed): $recipients is an untyped array and the
new loop adds one more access already covered by that rule.