[bshaffer]

Make it easier to construct and embed public JWKs (such as in DPoP jwk headers, see #9712) directly from existing keys:

• Add JWK::createFromKey() to export RSA, EC, EdDSA, and HMAC keys into JWK arrays
• Widen the $head docblock on JWT::encode() to array<string, mixed> so nested header objects like jwk pass static analysis

use Firebase\JWT\JWK;
use Firebase\JWT\JWT;

$privateKey = openssl_pkey_new([
    'private_key_type' => OPENSSL_KEYTYPE_EC,
    'curve_name' => 'prime256v1',
]);

$jwk = JWK::createFromKey($privateKey);

// Sign the DPoP proof JWT
$dpopProof = JWT::encode([
    'jti' => bin2hex(random_bytes(16)),
    'htm' => 'POST',
    'htu' => 'https://server.example.com/token',
    'iat' => time(),
], $privateKey, 'ES256', null, [
    'typ' => 'dpop+jwt',
    'jwk' => $jwk,
]);

// Verify the DPoP proof JWT using the public JWK
$decoded = JWT::decode($dpopProof, JWK::parseKey($jwk, 'ES256'));