Validate requests in APNSTestServer and fix JWT claim encoding

[kylebrowning]

The mock server was too lax to catch regressions — deleting the client's bearer-token code passed all 88 tests.

Server (matching documented APNs behavior):

• Validates authorization bearer JWTs (structure, ES256 header, iss, numeric iat ≤ 1h) → 403 MissingProviderToken/InvalidProviderToken/ExpiredProviderToken.
• Emits apns-unique-id on device-push responses; apns-request-id echoed on broadcast paths only.
• Channel create returns 201; malformed apns-id → 400 BadMessageId; real reason strings (BadPath, MissingChannelId).
• Per-type payload limits (VoIP 5 KB), topic-suffix enforcement per push type, background+priority-10 rejected, priority 1 and the controls push type accepted.
• Thread-safe captured state (NIOLockedValueBox), a broadcast request log, and a response-override hook for error-path tests.

Library fixes the new validation pinned:

• JWT iat was encoded as a JSON string (RFC 7519 requires a number) and kid was wrongly duplicated into the payload.
• Fixes the wall-clock race in testToken.