fix(github): backdate GitHub App JWT iat to tolerate clock drift

[abstrask]

Summary

GithubAppKey.CreateJwt set iat = now and exp = now + 600. GitHub rejects a JWT whose exp is more than 10 minutes in the future, so a host clock even 1s ahead of GitHub's made installation token requests fail with 401 ("'Expiration time' claim ('exp') is too far in the future").

This follows GitHub's recommendation: iat is backdated by 60s and exp is set to now + 540, so the token lifetime stays at 10 minutes. Added a unit test that checks both bounds.

GitHub docs: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app

Does this close any open issues?

Part of #9220 (the JWT part only; the silent cron failure and the 401 passthrough are left for separate PRs).