Validate ID Tokens on the `iat` Claim value.

**Description:**
According to rule 10 for the ID token validation in the OIDC spec [1], it says:
> The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.

Currently, the oidc-sdk rejects ID Token only if the `exp time > current time + skew`. Taking the `iat` Claim value and rejecting ID Tokens based on the age of the ID Token can prevent potential attacks.

Start in the OIDC SDK's ID-token validation path by locating the existing expiration-time and clock-skew checks. Read OIDC validation rule 10 and determine how this client-specific maximum token age should be configured and applied to the iat claim. Done means overly old or future-issued ID tokens are rejected while valid tokens continue to pass, with focused validation tests.

Written by the indexing model from the issue text.