Verify exp independently of signature

[maghoff]

Summary

Verify exp independently of signature. Checking the expiry of the token can be valuable regardless of verification of the signature. Implicitly verifying it unless --ignore-exp is specified seems to be the natural way of doing it in this tool.

My use case is this: I want to keep a locally cached JWT until it has expired, and only then mint a new one. The signature is implicitly trusted, I only have to check the expiry.

Preflight checklist

• Code formatted rustfmt ($ cargo fmt)
• Code linter check with clippy ($ cargo clippy)
• Relevant tests added
• Any new documentation added

Further notes

I'll be happy to write a test if the feature is accepted and a test is deemed necessary.

I have not added documentation. In fact, the way I read the current documentation leads me to believe that the functionality I have added is already the way it works.