fix(signature): apply the payload encoding to the clone, not the receiver

[Spomky]

Fixes #679.

JWSBuilder::addSignature() is documented as immutable ("This method will return a new JWSBuilder object") but it wrote isPayloadEncoded on $this before cloning:

if ($this->isPayloadEncoded === null) {
    $this->isPayloadEncoded = $isPayloadEncoded;   // mutates the receiver
} elseif ($this->isPayloadEncoded !== $isPayloadEncoded) {
    throw new InvalidArgumentException('Foreign payload encoding detected.');
}

The bundle registers the builder as a shared service, so a single addSignature() call on the injected instance permanently pinned the b64 mode of that service: every later, unrelated build failed with Foreign payload encoding detected..

The clone is now created before the state transition and the transition applied to it, exactly as JWEBuilder::addRecipient() already does with checkAndSetContentEncryptionAlgorithm(). The check order is unchanged, so the exceptions raised on invalid input are the same as before.

The regression test reuses one builder instance across two independent builds; it fails with Foreign payload encoding detected. on 4.2.x and passes with the fix.

The wider redesign — making the builders genuinely immutable so the create() reset becomes unnecessary — stays tracked for 4.3.0.

Checks

• phpunit -c .ci-tools/phpunit.xml.dist: 869 tests, 2541 assertions, OK (the 2 incomplete tests are pre-existing)
• ECS, PHPStan and Rector: clean