chore(docs): example of unsafe header decode in README

[saranshdhingra]

Is it worth making sure we return the headers from decodeHeaders as an array?

Headers often have dashed key names and in order to access them currently, the user will have to do: $cls->{'x-header-key'}.

In order to make sure we return array, I think it's best to add a default argument to JWT::jsonDecode which forwards the second param to \json_decode().

[bshaffer]

We do not want to add a utility function to decode headers because this could encourage our users to decode insecure headers (this happens before any validation occurs). To exclude these helpers is an intentional decision. Additionally, if users want to check their headers (insecurely), they can do so easily:

list($headersB64, $payloadB64, $sig) = explode('.', $jwt);
$headers = json_decode(base64_decode($headersB64), true);

[bshaffer]

It may be a good idea to add this to the README so that we do not keep getting these requests

[saranshdhingra]

It may be a good idea to add this to the README so that we do not keep getting these requests

Updated PR to only show the example in the readme.

[bshaffer]

Adds more disclaimers and information regarding unvalidated headers