Migrate from unmaintained `node-jose`

### Details

The `node-jose` package is no longer actively maintained. We've identified 3 viable options for dropping the `node-jose` dependency.

### Update Sept 8, 2026

The plan is to move forward with option 1b: Replace with `jose`v6

### Options

1a. Replace with `jose` v5

- jose v5 does not support the zip: DEF (DEFLATE) compression header we currently utilize. Receiver consumers (cc @elastic/platform-analytics) would also need to also upgrade, and identify any issues with this change. Receivers would not be able to decrypt any pre-cutoff data. So this is a breaking "on the wire" change.
- jose v5 FIPS compliancy will need to be evaluated. Bare `RSA-OAEP`( vs. current RSAES-OAEP, SHA-1 + MGF1-SHA-1) mandates `SHA-1`. This might need to be bumped to `RSA-OAEP-256`. Edit: it will need a bump to comply with FIPS 140-2 & 140-3. Another breaking 'on the wire' change.
- POC (`jose` v5): https://github.com/elastic/request-crypto/pull/53

1b. Replace with `jose`v6

- jose v6 is ESM only, so we would drop support for older node versions (only Node ≥20.19 - Kibana not affected)
- jose v6 does support zip: DEF
- Crypto implementation suffers just one change (zip: DEF is supported)
- ***Key wrap*** — `RSA-OAEP` (`RSAES-OAEP`, `SHA-1 + MGF1-SHA-1`) → `RSA-OAEP-256` *changed
- *Content encryption* — `A128CBC-HS256` (AES-128-CBC + HMAC-SHA-256) → unchanged
- *Compression* — `zip: DEF` (raw DEFLATE, RFC 1951) → unchanged
- *Serialization* — JWE compact, protected header `{zip,enc,alg,kid}` → unchanged
- *Key material* — RSA, as published in the JWKS → unchanged
- To be FIPS 140-3 compliant, the key wrap algorithm will need to drop SHA-1 in favor of SHA-256, or simply use `RSA-OAEP-256`. We need to determine if keeping backwards compatibility for receivers only is FIPS 140-3 compliant.
- POC (`jose` v6 ESM): https://github.com/elastic/request-crypto/pull/56

2. Replace with native implementation:

- Larger implementation change, but can keep a more congruent crypto implementation (including zip: DEF support)
- *Key wrap* — `RSA-OAEP` (RSAES-OAEP, SHA-1 + MGF1-SHA-1) → unchanged
- *Content encryption* — `A128CBC-HS256` (AES-128-CBC + HMAC-SHA-256) → unchanged
- *Compression* — `zip: DEF` (raw DEFLATE, RFC 1951) → unchanged
- *Serialization* — JWE compact, protected header `{zip,enc,alg,kid}` → unchanged
- *Key material* — RSA, as published in the JWKS → unchanged
- To be FIPS 140-3 compliant, the key wrap algorithm will need to drop SHA-1 in favor of SHA-256, or simply use RSA-OAEP-256. We need to determine if keeping backwards compatibility for receivers only is FIPS 140-3 compliant.
- POC: https://github.com/elastic/request-crypto/pull/55

*Note:* either option requires a major version bump because low level APIs will change