Bump jwt dependency to support 3.x

Inizia da getstream-ruby.gemspec e ispeziona i punti in cui l’SDK chiama jwt encode/decode, quindi esegui la suite di test esistente. Il lavoro è completato quando il vincolo della dipendenza supporta l’intervallo jwt 3.x scelto e CI copre jwt 3.x con i test superati.

Summary

The current gemspec pins jwt ~> 2.0, which forces consumers to stay on the 2.x line and prevents adopting jwt 3.x in any Ruby app that depends on this gem.

# getstream-ruby.gemspec (v6.1.1)
spec.add_dependency 'jwt', '~> 2.0'

Motivation

The jwt 3.x line introduced several hardenings that apps may want to opt into:

• Rejection of nil/empty HMAC keys at sign and verify (related to CVE-2026-45363 / GHSA-c32j-vqhx-rx3x)
• Enforcement of RSA keys >= 2048 bits
• Stricter RFC 4648 base64 decoding
• Mandatory signature verification before payload access

For consumers already running jwt 3.x in production, adding getstream-ruby currently forces a downgrade, which (a) loses those hardenings and (b) leaves the app stuck on whichever 2.x patch line ends up being the resolved version.

Question

Is bumping the constraint to allow jwt 3.x (e.g. jwt, '>= 2.0', '< 4' or jwt, '~> 3.0') on the roadmap? Quick scan of the SDK usage of jwt suggests the encode/decode call sites should be compatible across 2.x and 3.x, but the maintainers will know best.

There's prior precedent for loosening a dependency constraint in this gem (dotenv — see #25 and #27), so this would follow a similar pattern.

Happy to open a PR with the constraint bump (+ CI matrix entry for jwt 3.x) if that would help.

Thanks!