Fix Dependabot alert for firebase/php-jwt

[omniphx]

Summary

• narrow firebase/php-jwt to the secure ^7.0 line
• align the package PHP requirement to ^8.0, which matches the secure jwt major
• stop advertising vulnerable 5.x and 6.x installs to downstream consumers

Verification

• composer update --lock --no-install --no-scripts
• composer validate --no-check-publish
• vendor/bin/phpunit tests/Unit

Notes

• composer test still includes Salesforce integration tests that require outbound network access and credentials, so those were not runnable in this sandbox.