Not-before claim validation

This adds checking of `nbf` in addition to `exp`, piggybacking on the same `leeway` and `verify_expiration` parameters.