Builds the RFC 7515 signing input from raw protected-header bytes and raw payload bytes.
payload must be plain payload bytes; this helper base64url-encodes it internally.