Validate ID Tokens on the iat Claim value.

[chamathns]

Description:
According to rule 10 for the ID token validation in the OIDC spec [1], it says:

The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.

Currently, the oidc-sdk rejects ID Token only if the exp time > current time + skew. Taking the iat Claim value and rejecting ID Tokens based on the age of the ID Token can prevent potential attacks.