oauth2: configurable safety margin to expire cookies before the contained tokens expire

*Title*: oauth2: configurable safety margin to expire cookies before the contained tokens expire

*Description*:

Add a configurable safety margin to the OAuth2 HTTP filter so that the browser cookies it sets expire slightly earlier than the tokens they carry. This is the mirror of the `jwt_authn` filter's `clock_skew_seconds`. It shortens cookie validity so a request never arrives at the upstream.

This will prevent errors when the request processing takes seconds or a minute, and the upstream service invokes other services on behalf of the browser user, using the JWT injected by the OAuth2 filter. Using `clock_skew_seconds` does not help because the initial request gets accepted by the OAuth2 filter

A proposal:

```
http_filters:
- name: envoy.filters.http.oauth2
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
config:
# ...
# Expire/treat the auth cookies as invalid this many seconds before the
# contained token actually expires. Forces re-auth/refresh proactively.
cookie_expiry_margin: 30s # name TBD
```

Start at Envoy's OAuth2 HTTP filter and its OAuth2 v3 configuration, then trace how browser-cookie expiration is derived from the contained token's expiry. Compare the requested behavior with the jwt_authn filter's clock_skew_seconds. Done means the safety margin is configurable and cookies expire early enough to force re-authentication or refresh before an upstream request can use an expired token.

Written by the indexing model from the issue text.