facile-it/php-openid-client 0.3.x has implicitly nullable parameters,
which PHP 8.4+ reports as deprecations on every login callback.
0.4 fixes that, but php-jose-verifier 0.5 dropped withExpectedAlg():
the expected alg can only be set when the verifier is built.

- AlgAllowListIdTokenVerifier checks the header alg against the
  allow-list first and only then builds the upstream verifier with that
  alg pinned (id_token_signed_response_alg), so upstream still registers
  an AlgorithmChecker; with*() values are kept and replayed on it
- AsymmetricIdTokenVerifierBuilder passes a factory closure building the
  verifier the same way upstream IdTokenVerifierBuilder does
- add Nette Tester tests with locally signed tokens: valid RS256/ES256,
  rejected none/HS256/disallowed/unadvertised alg, nonce, aud, foreign
  key, logout tokens, and that the alg really gets pinned

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJXRqgKVcm7cADeGJ9P7e4