Bump PHP-JWT version #1276

The current version of PHP-JWT has a security advisory against it. Updating PHP-JWT to protect against the reported vulnerability is not possible without simultaneously bumping the PHP requirement for the PressForward plugin. We'll do this in #1274.

In the meantime, an analysis of the plugin's use of PHP-JWT suggests that we use HS256 encoding to generate keys, not RSA. This enforces a strength that's high enough to avoid the specific vulnerability reported in the advisor. So I don't see a practical risk in ignoring the advisory on builds on the 5.9.x series.