fix(core): keep the cause of a load or verification failure

[Spomky]

Closes #681.

When loading a token failed, every layer swallowed the exception explaining why, and the caller ended up with a bare Unable to load and verify the token. and no previous. Whatever the real reason was — malformed token, unsupported alg, rejected header, unusable key — the message was the same.

The last error met along the way is now chained as the previous exception. No BC break: the exception classes and the messages are unchanged, only getPrevious() is populated.

Changes

File	Change
JWSSerializerManager, JWESerializerManager	Unsupported input. now chains the last InvalidArgumentException thrown by a serializer
JWSLoader, JWELoader	the last error — serialization, header checker or key — is passed as $previous
JWSVerifier, JWEDecrypter	the per-key Throwables that are discarded to try the next key are reported to the caller

JWSVerifier::verifyWithKeySet() and JWEDecrypter::decryptUsingKeySet() return a bool and cannot throw without changing their semantics, and adding a parameter would break classes extending them. The callable that observes those failures is therefore passed as an undeclared additional argument and read with func_num_args()/func_get_arg(5) — the same pattern already used by JWEDecrypter::decryptCEK(). It will become part of the signature in 5.0.0. A subclass that overrides the method simply ignores it and behaves exactly as today.

Result

Exception - Unable to load and verify the token.
  -> InvalidArgumentException - The algorithm "RS256" is not supported.
  -> InvalidArgumentException - Wrong key type.
  -> InvalidHeaderException - Unsupported algorithm.
  -> InvalidArgumentException - Unsupported input. -> InvalidArgumentException - Unsupported input

One case still has no previous, by design: right kty, right alg, signature that does not match. No Throwable is thrown there — verify() simply returns false.

The dedicated exception hierarchy (so that catch (JoseException) becomes possible) remains the separate 4.3.0 issue.

Checks

• 876 tests pass, including 8 new ones covering serialization failure, unsupported algorithm, rejected key and header checker failure, for both JWS and JWE
• PHPStan, ECS and Rector are green