fix: reject JWTs with out-of-bounds exp/nbf/iat timestamps

[wasim-builds]

Fixes #1

This PR adds safe temporal bounds checking to JWT time claims (exp, nbf, iat) to prevent integer overflow and precision loss.

Changes:

• Validates time claims against safe Unix timestamp range (year 1 to year 9999)
• Rejects values that cause integer overflow (max/min int64) or floating-point truncation (1e21+)
• Returns specific error types: ErrInvalidEpoch, ErrExpiredToken, ErrTokenNotYetValid
• Handles edge cases: NaN, Inf, precision loss, min/max boundaries

Tests (all passing):

• Valid tokens, expired tokens, not-yet-valid tokens
• Max int64 overflow, min int64 overflow, 1e21 floating point
• Zero timestamp, year 9999 max, just beyond max
• Nil/empty claims, valid/overflowed iat

Acceptance Criteria Met:

• Validates exp/nbf/iat for safe Go time.Time conversion
• Rejects timestamps beyond year 9999 or causing overflow
• Returns specific actionable errors (ErrInvalidEpoch)
• Handles large floats (1e21), max int64, negative values

[wasim-builds]

/claim #1

[opirebot]

😅 Unfortunately there are no rewards left to claim in this issue!