fix(sdjwt): dump cnf.jwk in JSON mode so keys with "use" verify

[aeoess]

Description

Fixes #372

ParsedToken.cnf_jwk rebuilt the holder key with model_dump(exclude_none=True). In Python mode that returns use as the Use.sig enum member, and jwcrypto then rejects the key, so kb_sd_jwt.verify raised InvalidJWSSignature for any hop whose previous cnf.jwk carried "use": "sig". This change passes mode='json', the same fix #355 applies in delegate_claims_from_model. #355 does not touch cnf_jwk, so the two do not overlap.

The added test test_verify_accepts_cnf_jwk_with_use_and_alg builds a hop whose root cnf.jwk includes use and alg. It fails on main (InvalidJWSSignature) and passes with this change. A cnf.jwk without use still verifies as before.

Testing: pytest code/sdk/python/ap2/tests gives 187 passed and 2 failed. The same 2 tests (kb_sd_jwt_intermediate_tests.py::test_verify_rejects_aud_mismatch and test_verify_rejects_nonce_mismatch) fail identically on main without this change. ruff check and ruff format --check pass on both changed files.

• Follow the CONTRIBUTING guide
• Conventional commit title
• Tests and linter pass for the changed files