[lahirumaramba]

Fixes #3181

In v14.0.0, upgrading jwks-rsa to v4 introduced a synchronous CommonJS require('jose') call against jose v6, which only ships ES modules. On Node <22.12.0, and on serverless platforms like Vercel that start Node 22 and Node 24 with --no-experimental-require-module by default, importing firebase-admin/app-check, firebase-admin/phone-number-verification, or even firebase-admin/auth crashes immediately on startup with ERR_REQUIRE_ESM.

This PR removes jwks-rsa completely and fetches/converts JWKS public signing keys directly using our existing HttpClient and standard Web Crypto (globalThis.crypto.subtle). That preserves the 6-hour key cache and AppOptions.httpAgent support, eliminates the CJS/ESM boundary failure across all Node 22+ and serverless runtimes, and drops jwks-rsa, jose, and their transitive runtime dependencies.

Technical Details

• JwksFetcher in src/utils/jwt.ts fetches the JWKS JSON payload via HttpClient (forwarding httpAgent identically to UrlKeyFetcher) and converts public signing JWKs into SPKI PEM strings via crypto.subtle.importKey('jwk', ...) and crypto.subtle.exportKey('spki', ...).
• Supports RSA (RS256, RS384, RS512, PS256, PS384, PS512) and EC (P-256, P-384, P-521) signing keys.
• Validates base64url key parameters (n/e and x/y) and skips non-signing (use !== 'sig') or private JWKs (d, p, q, dp, dq, qi, oth) prior to import so malformed JWKs cannot produce degenerate public keys.
• Verified unit tests across jwt, app-check, auth, and phone-number-verification, as well as loading under node --no-experimental-require-module and Node v22.0.0 in both CommonJS and ESM.

[gemini-code-assist]

Code Review

This pull request removes the jwks-rsa dependency and replaces it with a custom implementation for fetching and parsing JSON Web Key Sets (JWKS) using the Web Crypto API in src/utils/jwt.ts. It also updates the corresponding unit tests to cover the new logic. The review feedback suggests two key improvements: first, using Node.js's native Buffer to convert the public key SPKI to base64 more efficiently and idiomatically; second, adding a safety check to ensure resp.data is a non-null object before accessing its properties to prevent a potential runtime crash.