Added claim for not before time (nbf) to coincide with issued at time.

This ensures JWT will not be considered valid for times before it was
issued. Failing to limit the validity in this manner is a potential
security hole.

jwt_signed/callout/src/main/java/com/apigee/callout/jwtsigned/JwtCreatorCallout.java

@@ -431,6 +431,7 @@ public ExecutionResult execute(MessageContext msgCtxt, ExecutionContext exeCtxt)
             if (AUDIENCE != null) claims.setAudience(java.util.Arrays.asList(AUDIENCE));
             if (JTI != null) claims.setJWTID(JTI);
             claims.setIssueTime(now);
+            claims.setNotBeforeTime(now);
             Date expiry = getExpiryDate(now,msgCtxt);
             if (expiry != null) { claims.setExpirationTime(expiry); }