NBF tolerances are too tight for JWT

[sblackstone]

Description

My computers clock was running 1 second ahead and that was enough to trigger NBF signature issues with the JWT code.

There should be atleast some tolerance in the NBF settings when decoding the JWT, e.g.

::JWT.decode(@token, secret, true, { nbf_leeway: 5, algorithm: "HS256" })

I'm running the normal Apple NTP settings, so this can happen to regular users.

[nelsonwittwer]

We noticed a similar problem and increased the JWT leeway to 10 seconds. We merged the fixed for the Ruby API gem yesterday. This will be included in the next release of the gem.

[sblackstone]

@nelsonwittwer This gem currently has its own JWT handling and does not use the shopify_api gem.....

Are you guys updating the logic in here to use the shopify api gem? Otherwise my PR #1440 is still necessary.

lib/shopify_app/session/jwt.rb