Update Macaroon claims/constraints for OIDC token minting

[woodruffw]

We're going to want to mint short-lived Warehouse API tokens (which are Macaroons) based on incoming OIDC JWTs.

As part of the "short-lived" part, we'll need need to make sure the tokens support some kind of expiration claim.

[woodruffw]

As part of this we'll probably want to revive some of the work in #6935, namely adding a TopLevelCaveat that dispatches to V1Caveat or V2Caveat depending on the version. V2Caveat can then be the main caveat format we use here.

[woodruffw]

I'm going to get started on this while #10753 is pending review.

[woodruffw]

#11122 addresses this.