Make Token\Builder really readonly

[Slamdunk]

As reported by PHPStan 2, the current Token\Builder implementation is not really readonly:

https://github.com/lcobucci/jwt/actions/runs/11784435253/job/32823593891?pr=1085#step:9:50

All attributes must be accepted only in its constructor.
But we can't do that on a public constructor because we need the safeguards provided by its API.

The solution is to add a new static function new() method as the public constructor, make the constructor private, and only then apply the readonly attribute, hence the BC-break label here

[Slamdunk]

Hey @Ocramius, what are those googly eyes?

[Ocramius]

Just for myself / that I've already seen this :)

I agree with masking the public constructor BTW.