Merge release 4.3.0 into 5.0.x

[github-actions]

Release Notes for 4.3.0

Feature release (minor)

4.3.0

• Total issues resolved: 0
• Total pull requests resolved: 4
• Total contributors: 4

Dependencies,Improvement

• 986: Allow lcobucci/clock:^3.0 to be installed with lcobucci/jwt:^4 thanks to @Ocramius

Improvement,Minor BC-break

• 968: Deprecate Ecdsa create thanks to @lcobucci

Improvement

• 938: Deprecate empty Signer, empty Key and empty Signature thanks to @Slamdunk

Documentation

• 879: fix typo : you must create a new token builder, thanks to @roxie-dev

[Slamdunk]

IMHO this shouldn't be merged at all: composer-normalize shouldn't be pinned in latest major, and 5.x already got a dedicated PR for lcobucci/clock.

[Ocramius]

A merge-up with bits removed should still occur, or otherwise it becomes harder and harder to forward -port patches: specifically important for security issues.

[Slamdunk]

I figured it, but how to remove the bits?

[Ocramius]

We do a git merge --no-ff 5.0.x locally, and adjust the final code before committing the merge 👍

[Slamdunk]

I hope I did it right

[Ocramius]

Excellent, thanks! 👍