OAuth includes a copy of JWT.php, which we include in the mediawiki-vendor repo, which works fine for those that use it, such as WMF
So, this extra version thats included as a PHP file should probably go, and moved into composer.json for the extension