Register the experimental algorithms again

[Spomky]

Target branch: 4.1.x

• It is a Bug fix
• It is a New feature
• It is related to dependencies

Includes:

• Breaks BC
• Deprecations

Since the folder rename (#510), the experimental algorithms live under Jose\Experimental\{Signature,KeyEncryption,ContentEncryption}, but the bundle was left behind: the three configuration files still imported them from Jose\Component.

That alone would have been noisy, but SignatureSource and EncryptionSource decide whether to load those files with a class_exists() check against the very same stale names:

HS1::class => 'signature_experimental.php',   // Jose\Component\Signature\Algorithm\HS1

The check always returned false, so the files were never loaded and the failure stayed silent. No experimental algorithm was reachable through the bundle at all: RS1, HS1, HS256/64, ES256K, BLAKE2B, A128CTR, A192CTR, A256CTR, RSA-OAEP-384, RSA-OAEP-512, the eight A*CCM-* and chacha20-poly1305.

A second defect

Loading them uncovered a copy-paste error: A256CCM_64_128 and A256CCM_64_64 returned the name of their 16 counterparts.

final class A256CCM_64_64 extends AESCCM
{
    public function name(): string
    {
        return 'A256CCM-16-64'; // should be A256CCM-64-64
    }
}

AlgorithmManager is keyed by name(), not by the DI alias, so these two replaced A256CCM-16-128 and A256CCM-16-64 in the manager and were themselves unreachable. A JWE built with them would also have carried the wrong enc header value. Only the names were wrong: IV size and tag length were already the expected ones in both classes.

Note on the baseline

Here too PHPStan had reported it, and twenty-two entries had been baselined:

Class Jose\Component\Signature\Algorithm\HS1 not found.
Class Jose\Component\Encryption\Algorithm\ContentEncryption\A128CCM_16_128 not found.

This PR drops all twenty-two.

Tests

tests/Bundle/JoseFramework/Functional/ExperimentalAlgorithmsTest.php asserts that every experimental alias is registered in the AlgorithmManagerFactory and resolvable, and that each A*CCM-* class reports its own name. Fifteen of its twenty-two tests fail without this fix.

PHPStan reports the same 30 errors as 4.1.x does today, Deptrac is clean, and the test suite fails on exactly the same tests as before.

Worth knowing when reviewing: the test kernel container is cached in var/cache/test. After touching anything under src/Bundle/Resources/config/, rm -rf var/cache is needed or the bundle tests keep asserting against the old container.