swarm-nats-auth: give issued user JWTs an exp

The user JWT the callout issues carried no exp, so nats-server armed no
expiry timer and a connection kept its grant until the client dropped it:
a deleted or re-minted agent queue secret, a removed OIDC client or an
expired access token never reached a live connection.

Every issued user JWT now expires at the presented OIDC token's exp
(read from the introspection answer) or an hour after issue, whichever
is sooner; the agent queue-secret path has no exp of its own and gets
the hour. Every queue client reconnects through an auth callback that
re-reads or re-mints its credential, so the forced reconnect presents a
current one.

Fixes #5432

swarm-nats-auth/src/xkey.rs

@@ -254,6 +254,7 @@ pub(crate) mod tests {
             &req.server_id.id,
             &req.user_nkey,
             &permissions,
+            None,
         );
         let reply = seal(&own, &server_key, token.as_bytes()).expect("sealed");
         assert_ne!(reply, token.as_bytes(), "the reply leaves sealed");