Fastlane: Bump jwt to 3.2.0 (GHSA-c32j-vqhx-rx3x)

[d4rken]

What changed

No user-facing behavior change. Resolves Dependabot alert #17 by bumping the jwt gem in the fastlane (release/CI) toolchain from 2.10.2 to 3.2.0, which patches a high-severity empty-key HMAC bypass (CVE-2026-45363).

Technical Context

• The vuln: jwt < 3.2.0 accepts an attacker-forged token when JWT.decode is called with an empty/nil HMAC key. Practical exposure in this repo is negligible — jwt is only a transitive dep of fastlane via googleauth, used for Google Play service-account auth with a real key, and never ships in the app. Bumping is to clear the alert.
• Why a simple jwt bump didn't work: jwt was capped below 3.0 by two parents — fastlane 2.233.1 (jwt < 3) and googleauth 1.11.2 (jwt < 3.0). Both upper bounds are relaxed to < 4 only in newer releases.
• The fix: bump fastlane → 2.235.0 (constraint now jwt < 4), which pulls googleauth → 1.16.2 (also jwt < 4), letting bundler resolve jwt 3.2.0. The incidental aws-sdk / google-apis bumps in the lockfile are the re-resolution of fastlane's transitive deps.
• BUNDLED WITH 2.2.8 → 2.6.2: required, not cosmetic — fastlane 2.235.0 declares bundler >= 2.4.0. CI's ruby/setup-ruby step uses bundler-cache: true, which installs the BUNDLED WITH version from the lockfile, so the runner picks up 2.6.2 automatically (ruby 3.3.6 unchanged).
• Verified locally: bundle check passes and bundle exec fastlane --version reports 2.235.0 (mirrors the CI "Verify fastlane Bundler wiring" step).

Closes GHSA-c32j-vqhx-rx3x