Handling of JWTs with no nbf (Not Before) claim

The nbf or Not Before claim is optional in JWTs: https://tools.ietf.org/html/rfc7519#section-4.1.5

In this code if the JWT contains no nbf claim it is treated as if it had an nbf claim equal to the exp (expiration) claim minus the not before leeway (which defaults to a few minutes).

https://github.com/hashicorp/vault-plugin-auth-jwt/blob/master/path_login.go#L153

That by itself seems kinda dubious. If nothing else it assumes that JWTs are commonly valid for only a few minutes, which is not typical in my experience.

Additionally there's no way to disable this behavior and just ignore the absence of an nbf claim. The documentation for [not_before_leeway](https://www.vaultproject.io/api/auth/jwt#not_before_leeway) says it can be set to -1 to disable it, but apparently "disable" here means don't allow any leeway:

https://github.com/hashicorp/vault-plugin-auth-jwt/blob/master/path_login.go#L172

I can see after reading it a few times what was meant, but it certainly confused me at first.

In our environment tokens are good for one hour by default, and have no nbf or iat claim. I've been able to work around this by setting not_before_leeway to 7200 (i.e. two hours), thus treating tokens like they had an nbf value of a couple of hours before they expire. It works, but I'd prefer an option to just disable the nbf checking.

Start in path_login.go around the nbf handling at lines 153 and 172, then compare the not_before_leeway behavior with the RFC 7519 section on the optional claim. Trace how a JWT without nbf is evaluated and how -1 is interpreted. Done means the absence of nbf can be ignored as requested, with the not_before_leeway documentation matching the behavior.

Written by the indexing model from the issue text.