Harden PHP SDK for public distribution

[danifronter]

What changed

• adopts Apache-2.0 and public distribution documentation
• verifies JWT signatures before trusting claims
• validates issuer, audience, authorized party, subject, nonce, and time claims
• adds constant-time authorization state validation
• enforces back-channel logout jti and prohibits nonce
• replaces smoke checks with cryptographic PHPUnit coverage
• adds PHPStan, PHP 8.2-8.5 CI, and Composer Audit

Security impact

The SDK now separates ID-token and logout-token validation rules and prevents unsigned claims from driving trust decisions.

Consumers remain responsible for storing authorization state server-side and rejecting replayed logout jti values.

Validation

• PHPUnit: 5 tests, 17 assertions
• PHPStan: no errors
• Composer validate: valid
• Composer audit: no advisories
• Gitleaks full Git history: no leaks