Encode expiration as iso8601 in UTC timezone.

Based on @chancancode's comment here: https://github.com/rails/globalid/commit/39ab83a43a64b339739c6e8c7ab24bb1325204ed#commitcomment-7529613

cc @jeremy @xuchu
Do we care about sub-second parts here? I think `iso8601` truncates to the second by default, is that Good Enough™? Or do we want to do something like `expires_at.utc.iso8601(3)`?