Add configurable clock skew

[cgostuff]

This implements clock skew similar to AzureAD. The existing solution with 5 min nbf leeway and a configurable time function does not let you get a true 5 min clock skew, because the time.now() function used to check expiry is reused to check the nbf-constraint.

This is configurable in .NET TokenValidationParameters.ClockSkew Property, and is used like this in IdentityServer4 PrivateKeyJwtSecretValidator.cs#L106.

[jordaniversen]

Any word on this? I was also looking for such a feature.