Checklist

• I've run bundle exec rspec from the root directory to see all new and existing tests pass
• I've followed the fastlane code style and run bundle exec rubocop -a to ensure the code style is valid
• I see several green ci/circleci builds in the "All checks have passed" section of my PR (connect CircleCI to GitHub if not)
• I've read the Contribution Guidelines
• I've updated the documentation if necessary.
• I've added or updated relevant unit tests.

Motivation and Context

Resolves #30055

ruby-jwt versions before the patched releases allow an empty HMAC key to verify attacker-crafted HS256 tokens when callers decode with an empty string key or a keyfinder that returns an empty string.

fastlane already widened the upper jwt dependency bound to allow the v3 series, but the lower bound still allowed vulnerable 2.x versions. During investigation, I confirmed that the fix was backported to jwt 2.10.3, so fastlane can require a patched version without forcing all users onto the v3 dependency path.

This keeps fastlane compatible with its current Ruby >= 3.0 minimum while still allowing safe jwt 3.2.0+ versions.

Description

This PR tightens fastlane's jwt dependency requirement to patched versions only.

The change:

• raises the minimum jwt version to 2.10.3
• excludes vulnerable jwt 3.0.0 through 3.1.2
• updates Gemfile.lock to resolve jwt 2.10.3
• adds a gemspec regression spec to ensure vulnerable versions are not accepted by the dependency requirement

I investigated the reported behavior by reproducing the empty-key HMAC verification with an affected jwt version, then verified that the updated dependency resolves to jwt 2.10.3 and rejects both the static empty-key and keyfinder empty-key cases.

Documentation was not changed because this is a dependency/security constraint update rather than a user-facing fastlane feature or configuration change.

Testing Steps

Reproduced the vulnerable behavior with an affected jwt version:

• crafted an HS256 token signed with an empty HMAC key
• verified that affected jwt accepted the token with both a static empty string key and a keyfinder returning ""

Verified the fixed behavior with the updated bundle:

• confirmed the bundle resolves to jwt 2.10.3
• confirmed the crafted empty-key token is rejected with JWT::DecodeError: HMAC key cannot be empty
• confirmed App Store Connect ES256 token generation still works