Fix JWT::JWK::Set sharing its key collection when copied

[anakinj]

Description

Fixes #750.

JWT::JWK::Set.new(other_set) returned the source set's keys array by reference, despite the # Simple duplication comment on that branch. The class also defined no initialize_copy, so dup and clone shared the array as well — a case not covered in the issue.

Mutating a copy through add, <<, delete, select!, reject! or uniq! therefore mutated the original too:

original = JWT::JWK::Set.new([jwk])
JWT::JWK::Set.new(original).reject! { true }
original.size # => 0

This matters because key sets are commonly cached and shared between consumers, so one caller filtering its own copy can silently empty another's.

union was unaffected, since merge rebinds @keys with += rather than mutating in place. There is a regression test for that too.

Both copy paths now dup the array. The JWT::JWK objects themselves are still shared — only the collection is copied.

Checklist

Before the PR can be merged be sure the following are checked:

• There are tests for the fix or feature added/changed
• A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md