Could we get a 2.X fix for CVE-2026-44351

Some of the packages my project depend on are still pinned to the 2.x version of jwt, looking at the changes in [Commit db560b7 (](https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f) it seems like it would be reasonable to back port this the 2.x stream