feat: make the algorithm, checker and serializer managers immutable

[Spomky]

Target branch: 4.3.x
Resolves issue #688

• It is a Bug fix
• It is a New feature
• It is related to dependencies

Includes:

• Breaks BC
• Deprecations

A manager expresses a policy — "these algorithms and no others". AlgorithmManager::add() let any consumer holding
the injected service widen that policy for every other consumer, so it is deprecated in favour of an immutable API.

AlgorithmManager

// before: mutates the shared service
$manager->add(new None());

// after: explicit, local, no side effect
$manager = $manager->with(new None());

• with(Algorithm ...$algorithms): self returns a new manager supporting the current algorithms plus the given ones.
  An algorithm whose name is already supported replaces the previous one, as add() did.
• add() still works and still mutates, but triggers a deprecation. The constructor does not go through it any more,
  so building a manager is silent.
• $algorithms stays writable: readonly there would break the deprecated add().

The other managers

HeaderCheckerManager, ClaimCheckerManager, JWSSerializerManager and JWESerializerManager already had a private
add(), so they only needed their state closed: the properties are now readonly and filled once by the constructor,
and the now-unused private add()/addTokenTypeSupport() methods are gone. Both serializer managers, already final,
became readonly classes (asked for by Rector, and equivalent here since they hold a single property).

The two checker managers stay non-final: the bundle extends them to dispatch events. Their docblock records that
they will be final in 5.0.0.

No public signature changed and no behaviour changed for existing callers, so nothing breaks. with() was
deliberately not added to the four other managers: their add() was never public, and 5.0.0 is where the whole family
gets the same treatment.

Tests

• AlgorithmManagerTest covers with() (new instance, original untouched, several algorithms at once, replacement by
  name, no deprecation) and add() (deprecation triggered, mutation preserved).
• ImmutableManagerStateTest asserts the state of the four other managers is readonly, so a later change cannot
  quietly reopen it.

Full suite, ECS, PHPStan, Rector and Deptrac are green; the managers were also smoke-tested on PHP 8.2, the minimum
supported version, for the readonly class syntax.