move jwt header to `build` and add header input in `sign`

[hugomrdias]

Good point, but I wonder if that should be controlled by the build.

Basically sign should accept a header, payload, and the key pair.

Honestly not a big deal, just capturing thoughts while I go through the code.

Originally posted by @flea89 in https://github.com/nftstorage/ucan.storage/pull/3#discussion_r820646943