Composer: firebase/php-jwt not loaded because of security advisories

Problem/Motivation

Composer update:

    - Root composer.json requires drupal/commerce_paypal ^2.1 -> satisfiable by drupal/commerce_paypal[2.1.0].
    - drupal/commerce_paypal 2.1.0 requires sainsburys/guzzle-oauth2-plugin ^3.0 -> satisfiable by sainsburys/guzzle-oauth2-plugin[v3.0.0, ..., v3.0.7].
    - sainsburys/guzzle-oauth2-plugin[v3.0.0, ..., v3.0.1] require firebase/php-jwt ~3.0 -> found firebase/php-jwt[v3.0.0] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys", "PKSA-2kqm-ps5x-s4f5"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
...
    - sainsburys/guzzle-oauth2-plugin[v3.0.6, ..., v3.0.7] require firebase/php-jwt ^3.0|^4.0|^5.0|^6.0 -> found firebase/php-jwt[v3.0.0, v4.0.0, v5.0.0, ..., v5.5.1, v6.0.0, ..., v6.11.1] but these were not loaded, because they are affected by security advisories ("PKSA-y2cr-5h3j-g3ys", "PKSA-2kqm-ps5x-s4f5"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

Looks like we need to update to firebase/php-jwt version 7 to avoid these security advisories...