Do not use header's jwk automatically

Editor assessment

This commit patches CVE-2026-27962. 'fix(jose): do not use header's jwk automatically' identifies both the area and the unsafe behavior being removed, which is enough to follow the change. It is a one-line message with no body, though, so nothing explains the header-injection threat, why embedded keys were trusted, or whether a key-resolution parameter now replaces the automatic path. The jose scope is precise and the fix type is right. Missing is any test or advisory footer, and the security reasoning lives only in the reader's head. Understandable and correct, but it under-sells a subtle JWT verification fix.