Update firebase/php-jwt to ^7.0 to fix security vulnerability

Resolves #454. The firebase/php-jwt ^5.2 || ^6.2 constraint is affected
by security advisory GHSA-2x45-7fc3-mxwq (CVE-2025-45769), which
prevents Composer from installing the library without warnings.

- Update firebase/php-jwt constraint to ^7.0
- Regenerate composer.lock on PHP 8.1 to maintain compatibility
- Update test secrets to meet v7 minimum HMAC key size (32 bytes)
- Extract test secrets into named constants for readability
- Fix broken packagist link in README

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lizkenyon

CHANGELOG.md

@@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
+- [#456](https://github.com/Shopify/shopify-api-php/pull/456) [Patch] Update firebase/php-jwt to ^7.0 to address security vulnerability (GHSA-2x45-7fc3-mxwq)
 
 ## v6.1.0 - 2026-01-21
 - [#450](https://github.com/Shopify/shopify-api-php/pull/450) [Minor] Add support for 2026-01 API version

README.md

@@ -1,4 +1,4 @@
-**Note:** We've released a new experimental package for PHP. Please read [rethinking our support for PHP & Python packages](https://community.shopify.dev/t/rethinking-support-for-php-python-packages/28325). The new PHP package supports the latest Shopify platform features and we'd love your feedback. Please see [shopify-app-php](packagist.org/packages/shopify/shopify-app-php) to get started.
+**Note:** We've released a new experimental package for PHP. Please read [rethinking our support for PHP & Python packages](https://community.shopify.dev/t/rethinking-support-for-php-python-packages/28325). The new PHP package supports the latest Shopify platform features and we'd love your feedback. Please see [shopify-app-php](https://packagist.org/packages/shopify/shopify-app-php) to get started.
 
 # Shopify API Library for PHP
 

composer.json

@@ -27,7 +27,7 @@
         "ext-json": "*",
         "ext-mbstring": "*",
         "doctrine/inflector": "^2.0",
-        "firebase/php-jwt": "^5.2 || ^6.2",
+        "firebase/php-jwt": "^7.0",
         "guzzlehttp/guzzle": "^7.0",
         "guzzlehttp/psr7": "^2.0",
         "psr/http-client": "^1.0",