Fix GitHub App authentication on runners with minor clock drift (#2289)

## Why

GitHub App authentication intermittently failed with `401
(Unauthorized)` during steps like "Download Project Dependencies", but
only on self-hosted runners. The same repo, project, App, and dependency
worked fine on GitHub-hosted runners. The differentiator was the
runner's clock.

## Root cause

`GenerateJwtForTokenRequest` backdated the JWT `iat` ("issued at") claim
by only 10 seconds. GitHub rejects a JWT whose `iat` is in its future. A
self-hosted runner whose clock runs more than ~10 seconds ahead of
GitHub therefore produces a future-dated `iat`, and the JWT-only call
(`GET /repos/.../installation`, made before any installation token
exists) gets a 401. GitHub-hosted runners are tightly time-synced, so
they never hit this.

## Fix

Backdate `iat` by 60 seconds instead of 10, [as recommended by
GitHub](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app#about-json-web-tokens-jwts),
to tolerate runners whose clock runs slightly ahead. The `exp` claim is
left at 10 minutes (already within GitHub's "no more than 10 minutes
into the future" limit).

This is intentionally minimal: a one-line change to the backdate plus a
release note. Keeping the runner clock synchronized (e.g. via NTP) is
still recommended, but AL-Go now tolerates the small drift commonly seen
on self-hosted runners.

Fixes: #2284

---------

Co-authored-by: aholstrup1 <aholstrup1@users.noreply.github.com>