Token lifetime configurable in token request

[hshort]

There seems to be an increasing demand to provide a configurable token lifetime based on a parameter in the initial token request. For example, perhaps a scope could be used to modify the lifetime. This would allow tools such as Rucio to tune the lifetime based on the risk profile of the process. There would need to be a maximum set for the client to mitigate risk. This issue is to start a small discussion on whether it is a useful feature, whether it is somehow supported in the standard already, and how it could be done.