Add note about using a hard coded algorithm in README

[revodoge]

I've seen code 'working around' the added security of algorithm parameter by extracting the algorithm from the JWT without verification first, and then passing that algorithm into the JWT verification.

Unfortunately, I don't think there's really a good way to programmatically enforce such a thing. You may be able to require the parameter to be a literal string or a symbol, but I don't know how effective that'd work in practice.

At the very least, I think it's worth adding an additional note in the readme about the algorithm to be more clear for those that don't click into the linked article.

[sourcelevel-bot]

Hello, @revodoge! This is your first Pull Request that will be reviewed by Ebert, an automatic Code Review service. It will leave comments on this diff with potential issues and style violations found in the code as you push new commits. You can also see all the issues found on this Pull Request on its review page. Please check our documentation for more information.

[excpt]

Thank you very much for the improvement.