web-token/jwt-framework

web-token/jwt-framework: Unprotected header override of 'alg' in JWSVerifier and JWEDecrypter

JWSVerifier::getAlgorithm() merges protected and unprotected headers using spread operator, allowing unprotected header to overrid