Allow to set a default expiration value on the generated token

[dunglas]

Generating JWT without expiration is a bad security practice. This PR adds the ability to set a default lifetime for generated tokens using the new Authorization util.

[chalasr]

👍 For the record, I think this is the only standard claim that should be set with a good default by this library.
I mean, after the recent work done on the authorization part, people will eventually start asking for iss and other claims to be set automatically, then ask for a configurable clock skew, ... endless story.
The answer should remain the same as before to me: decorate the existing token provider/factory on your own, the system is flexible and pluggable enough.

[dunglas]

I changed how the exp claim is generated, and added a way to control the cookie expiration time accordingly:

the lifetime of the cookie, the "exp" claim of the JWT will be set accordingly, set to null to use the default value and to 0 to set a session cookie (the default expiration time of the JWT will be 1 hour)