feat(core): JWK Thumbprint URI (RFC 9278)

[Spomky]

Context

RFC 9278 defines the JWK Thumbprint URI: urn:ietf:params:oauth:jwk-thumbprint:<hash-alg>:<thumbprint>, where <hash-alg> is a name from the IANA "Named Information Hash Algorithm" registry (sha-256, sha-512…) and <thumbprint> is the RFC 7638 base64url thumbprint. The URI is the key-based sub / kid used by OAuth DPoP, OpenID for Verifiable Credentials, SIOP v2 and OpenID Federation; every implementer of those profiles has to build it by hand today.

JWK::thumbprint(string $hash_algorithm) computes the RFC 7638 value (src/Library/Core/JWK.php) and key:thumbprint exposes it on the console; nothing produces or parses the URI form.

Scope

• JWK::thumbprintUri(string $hashAlgorithm = 'sha-256'): string — accepts the IANA hash name, maps it to the PHP hash() name (sha-256 → sha256, sha-512 → sha512, sha3-256…), builds the URI. Unknown or unmapped names throw UnsupportedAlgorithmException. The RFC 7638 computation is not duplicated: it calls thumbprint(), so the AKP case of feat(signature): ML-DSA-44/65/87 and the AKP key type via OpenSSL 3.5 (RFC 9964) #723 flows through.
• A static helper to match a URI against a key (JWK::matchesThumbprintUri(string $uri): bool, or a small JwkThumbprintUri value object with parse() / hashAlgorithm() / thumbprint()), for the verifier side: given the sub of a DPoP proof or a SIOP id_token, find the key in a JWKSet. JWKSet::selectKey() is the natural home for a lookup by thumbprint URI.
• Console: key:thumbprint gains a --uri flag (or the output shows both), taking the IANA hash name.
• Docs: a paragraph in the JWK section with the URI form, the hash-name mapping and the kid usage; changelog.

Out of scope

• Any DPoP / SIOP / OID4VC logic — this is only the identifier.
• Changing what thumbprint() hashes (RFC 7638 members, AKP handled in feat(signature): ML-DSA-44/65/87 and the AKP key type via OpenSSL 3.5 (RFC 9964) #723).

Acceptance criteria

• The RFC 9278 §3 example (the RFC 7638 §3.1 RSA key, sha-256) yields urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs.
• sha-512 and sha3-256 URIs are produced and parsed; md5 and an unknown name are refused.
• A JWKSet lookup by thumbprint URI returns the matching key and null otherwise.

References

• RFC 9278 §2 (syntax), §3 (example), §4 (security), §5 (IANA)
• RFC 7638 §3 (thumbprint computation)
• IANA Named Information Hash Algorithm Registry (hash names)