utils: Use iat field as fallback when auth_time is not provided

The auth_time is not always provided depending on the authentication flow used. The field iat is provided for example in the direct grant access flow so use it instead as fallback.

Related to swh-deposit#2858 (closed)

• [1] Related to swh/meta$972

• [2] https://github.com/keycloak/keycloak-documentation/blob/master/server_development/topics/action-token-spi.adoc#anatomy-of-action-token

---

Migrated from D5243 (view on Phabricator)