assertion.verify(): allow clock-skew tolerance to be overridden

We still need to support the new options object in cert.verify(),
cert.verifyBundle(), and jwcrypto.verify(). Also tests.