Adds max_age role parameter and auth_time claim validation

[austingebauer]

Overview

This PR adds a new max_age parameter to roles. The max_age specifies the allowable elapsed time in seconds since the last time the user actively authenticated with the configured identity provider.

When max_age is used, the ID Token returned must include an auth_time claim value (see openid-connect-core-1_0.html#AuthRequest). Validation of the auth_time claim value is provided by the cap/oidc library (see oidc/provider.go#L414).

The max_age for a role will be included in the generated auth URL as a query parameter, similar to the following example:

https://example.auth0.com/authorize?client_id=abc&max_age=60&nonce=n_NEJOgEMl4MBXf0LX6ES4&redirect_uri=https%3A%2F%2Fexample.com&response_type=code&scope=openid&state=st_o1myOrU9vQi6uiiR6SpU

Testing

I've added a test for setting the max_age role parameter and generating an auth URL with the max_age query parameter.

I've also manually tested Azure Active Directory authentication using max_age to observe that active authentication was forced depending on the max_age and time of last active authentication.

[catsby]

LGTM 👍