Custom time skew for IdToken validation

[sobrics]

Checklist

• I read the Contribution Guidelines
• I signed the CLA and WG Agreements
• I ran, updated and added unit tests as necessary.
• I verified the contribution matches existing coding style.
• I updated the documentation if necessary.

Motivation and Context

In MercadonaIT, we have found that the clock on some devices can exceed the default time skew value of 10 minutes.

As described in 3.1.3.7 Id Token Validation, Rule 10 indicates that the time skew range is client specific, but currently, the library does not provide options to modify it.

The goal of this change is to add the ability to disable or modify the allowed time skew for the issued at (iat) field of the ID Token.

---

Description

I followed a similar approach as #662 already did for skipping the issuer https check.

Key changes:

• The option setAllowedTimeSkew() is added to modify the allowed time skew (default: 10 minutes).
• The option setSkipTimeValidation() is added to completely disable time validation (recommended only for development environments).

Example usage:

Modify the allowed time skew:

AppAuthConfigurationappAuthConfig = newAppAuthConfiguration.Builder()
.setAllowedTimeSkew(TWENTY_MINUTES_IN_SECONDS)
.build();

Disable time validation (for development only):

AppAuthConfigurationappAuthConfig = newAppAuthConfiguration.Builder()
.setSkipTimeValidation(true)
.build();

[svenjacobs]

Thanks for your PR! This is an important topic and issue that we face regularly. It has been mentioned here for example. Let's please get this merged 🙏🏻

[SamC-Apadmi]

Can this me merged? I'd really like to be able to use this!

[svenjacobs]

Can this me merged? I'd really like to be able to use this!

This project is largely unmaintained, I'm afraid.

[Juniorlpes]

It's exactly what I need.