Fix JWT::JWK::Set sharing its key collection when copied

[anakinj]

Description

Fixes #750.

JWT::JWK::Set.new(other_set) returned the source set's keys array by reference, despite the # Simple duplication comment on that branch. The class also defined no initialize_copy, so dup and clone shared the array as well — a case not covered in the issue.

Mutating a copy through add, <<, delete, select!, reject! or uniq! therefore mutated the original too:

original = JWT::JWK::Set.new([jwk])
JWT::JWK::Set.new(original).reject! { true }
original.size # => 0

This matters because key sets are commonly cached and shared between consumers, so one caller filtering its own copy can silently empty another's.

union was unaffected, since merge rebinds @keys with += rather than mutating in place. There is a regression test for that too.

Both copy paths now dup the array. The JWT::JWK objects themselves are still shared — only the collection is copied.

Checklist

Before the PR can be merged be sure the following are checked:

• There are tests for the fix or feature added/changed
• A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md

[Copilot]

🟡 Changes recommended

initialize_copy should duplicate @keys directly to avoid corrupting copied subclass state through an overridden accessor.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Fixes shared key-array ownership when copying JWT::JWK::Set instances.

Changes:

• Duplicates key collections during construction and object copying.
• Adds regression tests.
• Updates the changelog.

File summaries

File	Description
lib/jwt/jwk/set.rb	Adds independent collection copying.
spec/jwt/jwk/set_spec.rb	Tests copy isolation.
CHANGELOG.md	Documents the fix.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.