Collector OpAMP token validation does not require an expiration claim

`AgentTokenService#validateAgentToken` parses agent JWTs with JJWT's `parseSignedClaims`, which validates the `exp` claim only if present. A token without an `exp` claim is accepted and never expires.

## Proposed fix

In `AgentTokenService#validateAgentToken`:

1. Reject tokens without an `exp` claim (post-parse check on `claims.getPayload().getExpiration()`.
2. Enforce a server-side maximum token lifetime (e.g. 1 hour) so an agent-chosen far-future `exp` is also rejected.

Before picking a maximum lifetime, verify which token TTL the collector agent actually uses — a cap shorter than the agent's token lifetime would lock out all collectors.

Example:

```java
private static final Duration MAX_TOKEN_LIFETIME = Duration.ofHours(1);

final Date expiration = claims.getPayload().getExpiration();
if (expiration == null) {
throw new SecurityException("Agent token has no expiration time (exp claim)");
}
if (expiration.toInstant().isAfter(now.toInstant().plus(MAX_TOKEN_LIFETIME))) {
throw new SecurityException("Agent token expiration exceeds maximum allowed lifetime");
}
```