chore: Resolves Issue #92, updates to use transitive dependency explicit

[blochs]

Changes

Replaced deprecated authlib.jose usage with Authlib’s transitive joserfc dependency.

This removes the AuthlibDeprecationWarning emitted by Authlib 1.7+ while preserving existing JWT, JWK, and DPoP behavior.

Additional changes:

• No endpoints were added, deleted, deprecated, or changed.
• ApiClientOptions now accepts jwt_algorithms, defaulting to ["RS256"].
• Access-token verification supports configurable signing algorithms.
• DPoP verification remains restricted to ES256.
• Updated JWT test utilities to work with joserfc’s stricter header validation.
• No UI changes or screenshots are applicable.

Example:

ApiClientOptions(
    domain="example.us.auth0.com",
    audience="my-api",
    jwt_algorithms=["RS384", "RS512"],
)

Alternative approaches considered:

• Pinning Authlib below 1.7, which would only postpone the deprecation.
• Adding joserfc as a direct dependency, but it remains transitive as requested.
• Suppressing the warning, which would leave deprecated API usage in place.

References

• Issue #92
• [Authlib JOSE migration guide](https://docs.authlib.org/en/latest/upgrades/jose.html)
• [joserfc documentation](https://jose.authlib.org/en/)

Testing

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on Python 3.13.7

Reviewers can run:

PYTHONPATH=src pytest tests/test_api_client.py tests/test_utils.py -q

Result: 210 passed.

The test suite verifies JWT verification, DPoP verification, malformed DPoP headers, configurable algorithms, and existing behavior.

Checklist

• I have read the [Auth0 general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
• I have read the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
• All existing and new tests complete without errors