Bugfix: downgrade nimbus version to 3.37

chore: downgrade nimbus version to 3.37, see https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/545/jweobjectdecrypt-must-reject-compressed