perf(rust): remove redundant copies and re-parsing on secondary decode/encode paths

[ZhuchkaTriplesix]

Problem

Small redundant allocations/work on secondary paths:

• get_unverified_header / decode_unverified (rust/src/api.rs:343, :354): token.to_owned() just to move into detach — a &str can be captured directly. get_unverified_header also splits the token twice (ensure_valid_compact_jwt + parse_compact_header_json).
• decode_unverified uses dangerous::insecure_decode, which parses the header more than once; the single-pass helpers in jws.rs can be reused.
• decode_verified_complete (rust/src/api.rs:240-243): token is split again and the signature base64-decoded twice (once inside jwt_crypto_verify, once in extract_signature_bytes).
• jws_parse_compact copies the token and returns a signing_input bytes object that the only Python caller discards (_s in api_jwt.py).
• encode_json (rust/src/api.rs:444, :452-458): payload_bytes.to_vec() plus two format! allocations — can build the final token in one pre-sized String.

Acceptance criteria

• Each item above addressed or explicitly dropped with a reason
• No behavior change; tests green

Files

• rust/src/api.rs, rust/src/jws.rs, python/oxyjwt/api_jwt.py

Branch

issue/<N>-minor-alloc-cleanup from dev

[ZhuchkaTriplesix]

Fixed in #131 (merged to dev).