[saadkhantareen]

Summary

Add PyJWK.thumbprint() to compute the JWK thumbprint defined by RFC 7638. This was requested in #1032 and is needed for protocols such as DPoP (RFC 9449), which identify keys by their JWK thumbprint.

Changes

• Add PyJWK.thumbprint(hash_algorithm="SHA-256") in jwt/api_jwk.py: builds the JSON object containing only the members required for the key's kty (EC: crv, kty, x, y; OKP: crv, kty, x; RSA: e, kty, n; oct: k, kty), serializes it with members in lexicographic order and no whitespace, hashes it, and returns the Base64URL-encoded digest without padding. Members such as kid, alg and use do not affect the result.
• Raise InvalidKeyError when the key type is unsupported or a required member is missing, and ValueError for an unknown hash algorithm.
• Add tests covering the RFC 7638 Section 3.1 example vector, insensitivity to non-required members, the EC, OKP, RSA and oct key types, a non-default hash algorithm, and the error cases.
• Add a CHANGELOG entry under Unreleased.

Tests

• python -m pytest tests/test_api_jwk.py -q — 29 passed, 3 skipped (the 3 skips are pre-existing tests for running without the cryptography package).
• The RFC 7638 Section 3.1 example JWK produces the expected thumbprint NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs.
• ruff check jwt/api_jwk.py tests/test_api_jwk.py — all checks passed.

Fixes #1032

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.