Update minishlink/web-push to ^10 to drop abandoned web-token/jwt-* and fgrosse/phpasn1 dependencies

Problem/Motivation

drupal/web_push_api (1.x branch, current HEAD) pins in its composer.json:

"minishlink/web-push": "^6"

This constraint pulls in a chain of packages flagged as abandoned on Packagist: web-token/jwt-core, web-token/jwt-key-mgmt, web-token/jwt-signature, web-token/jwt-signature-algorithm-ecdsa, web-token/jwt-util-ecc, and transitively fgrosse/phpasn1.

composer audit --locked does not report any active CVE against these packages today, but since they are abandoned they will not receive a fix if one is ever found, and they generate constant noise in dependency audits for sites consuming this module.

minishlink/web-push v10.1.0 replaces this entire chain with a single maintained package, web-token/jwt-library (^3.4.9|^4.0.6), and requires PHP >=8.2.

Steps to reproduce

1. composer require drupal/web_push_api
2. composer why fgrosse/phpasn1 / composer why web-token/jwt-core — shows the chain coming through minishlink/web-push.
3. composer audit --locked — reports the packages as abandoned.

Proposed resolution

Update the module's require to "minishlink/web-push": "^10.1" and adjust the wrapper (src/Component/WebPush.php and related classes) to the minishlink/web-push v10.x API. A reference patch will be attached once validated.

Remaining tasks

• Confirm composer update resolves without conflicts.
• Review API changes in the module's wrapper classes.
• Bump the module's PHP requirement if needed (v10 requires >=8.2).