Bump jwt dependency to support 3.x

从 getstream-ruby.gemspec 开始，检查 SDK 中 jwt encode/decode 的调用位置，然后运行现有测试套件。依赖约束支持所选的 jwt 3.x 范围，并且 CI 覆盖 jwt 3.x 且测试通过，即表示完成。

Summary

The current gemspec pins jwt ~> 2.0, which forces consumers to stay on the 2.x line and prevents adopting jwt 3.x in any Ruby app that depends on this gem.

# getstream-ruby.gemspec (v6.1.1)
spec.add_dependency 'jwt', '~> 2.0'

Motivation

The jwt 3.x line introduced several hardenings that apps may want to opt into:

• Rejection of nil/empty HMAC keys at sign and verify (related to CVE-2026-45363 / GHSA-c32j-vqhx-rx3x)
• Enforcement of RSA keys >= 2048 bits
• Stricter RFC 4648 base64 decoding
• Mandatory signature verification before payload access

For consumers already running jwt 3.x in production, adding getstream-ruby currently forces a downgrade, which (a) loses those hardenings and (b) leaves the app stuck on whichever 2.x patch line ends up being the resolved version.

Question

Is bumping the constraint to allow jwt 3.x (e.g. jwt, '>= 2.0', '< 4' or jwt, '~> 3.0') on the roadmap? Quick scan of the SDK usage of jwt suggests the encode/decode call sites should be compatible across 2.x and 3.x, but the maintainers will know best.

There's prior precedent for loosening a dependency constraint in this gem (dotenv — see #25 and #27), so this would follow a similar pattern.

Happy to open a PR with the constraint bump (+ CI matrix entry for jwt 3.x) if that would help.

Thanks!