refactor(deps): Migrate from `jws` library

[danielbankhead]

jws hasn't been maintained for 4+ years - we should migrate to another JWT library.

Here's a nice list: https://jwt.io/libraries

• jose looks solid

Also consider compatibility and any significant changes in bundle size.

[TeemuKoivisto]

Seems nothing has happened but you definitely should. jws doesn't work in CloudFlare workers and probably other places as well

[d-goog]

This is currently blocking Node v24 adoption; increasing the priority of this issue.

Some notes:

• jose would greatly increase the size of this library:
  • jose@6.0.11 is 64.8 kB minified: https://bundlephobia.com/package/jose@6.0.11
  • google-auth-library@9.15.1 is 174.4 kB minified: https://bundlephobia.com/package/google-auth-library@9.15.1
  • jws@4.0.0 is 10.1 kB minified: https://bundlephobia.com/package/jws@4.0.0

Today, we only use jws's #sign method through the public APIs - looking into the complexity of implementing/maintaining internally...

[panva]

• jose would greatly increase the size of this library:

  • jose@6.0.11 is 64.8 kB minified: https://bundlephobia.com/package/jose@6.0.11

jose is tree-shakeable ESM with 0 dependencies. bundlephobia is not a reliable bundle size tool if you're shaking off what you don't use. CompactSign (equivalent of jws's sign()) sits at 15kb minified.