Make upstream connection close on jwt expiry configurable

Currently, when authenticating and connecting an `upstream` via `jwt`, `piko` will observe a `jwt` expiration and [close an upstream connection](https://github.com/andydunstall/piko/blob/3b81333a25819887e374656b849f52806e90f88a/server/upstream/server.go#L218) once the `jwt` expires. Consider a signed `jwt` that is not scoped to any particular endpoint. It can be used multiple times to register upstreams at various endpoints. If this token were ever stolen, it could be misused indefinitely unless the signing CA was changed. To prevent theft or misuse, we might set an expiration on the token and make it short-lived, but this would also make the registered upstream service short-lived: the upstream service's lifetime is coupled with the `jwt's`. That said, would it be possible to decouple these either by: - Making the [close on expiry behavior](https://github.com/andydunstall/piko/blob/3b81333a25819887e374656b849f52806e90f88a/server/upstream/server.go#L218) configurable? - Adding a separate claim for upstream expiration? The latter would be the most flexible allowing bounds for both `jwt` and upstream connection lifetime to be set separately by the `jwt` issuer. Would you be open to making that change or accepting a PR to that effect? Thanks!