Use jose instead of jsonwebtoken

[hdsuperman]

jsonwebtoken hasn't been updated in two years, and its dependencies, like safe-buffer, are no longer necessary. These dependencies don't support ESM, causing errors when packaging with tools like esbuild.

> pnpm why safe-buffer
@apple/app-store-server-library 1.6.0
└─┬ jsonwebtoken 9.0.2
  └─┬ jws 3.2.2
    ├─┬ jwa 1.4.2
    │ ├─┬ ecdsa-sig-formatter 1.0.11
    │ │ └── safe-buffer 5.2.1
    │ └── safe-buffer 5.2.1
    └── safe-buffer 5.2.1

jose supports ESM and has zero dependencies.