Add Customisable Maximum Token Lifetime

[artskidesign]

This PR updates the token.php file to allow external plugins to set a custom maximum token lifetime.

Changes include:

• New Filter Added: Introduced the vip_decoupled_max_token_lifetime filter.
• Updated Function: Modified get_token_lifetime_in_seconds to use this filter, allowing the maximum token lifetime ($max_lifetime) to be adjusted externally.

Impact:
Allows more flexibility in setting token lifetimes through external plugins.
Maintains default maximum lifetime unless specifically overridden.

[smithjw1]

@chriszarate I'm interested in your take on this from a security standpoint. Longer-lived tokens are riskier. Should we set a "supermax" lifetime or leave this completely configurable by bundle users?

[pwestern]

@smithjw1 just to quickly weigh in here - we have a business case to extend preview token lifetimes. In our case, we don't have any security concerns, but appreciate this won't apply to everyone. Having a way to extend the lifetime beyond 3hrs would be super helpful, so any hooks to configure would be really appreciated

[chriszarate]

Longer-lived tokens are riskier. Should we set a "supermax" lifetime or leave this completely configurable by bundle users?

I'm open to increasing the default max. Three hours was a somewhat arbitrary decision. The risk of a long-lived token is scoped to "viewing the latest revision of a specific post." I think different organizations will have different ideas about how to interpret that risk.

@pwestern @artskidesign What would a more reasonable max token lifetime look like for your use case?

[pwestern]

@chriszarate the request we've had from the business is to extend the lifetime indefinitely - which we appreciate is far longer than many other users are likely to need. Our hope was that there would be a way to override the default max token lifetime so we could set it to 1 year.

[smithjw1]

Thanks for making this suggestion, happy to approve these changes.

[alecgeatches]

Merging these changes in. Thank you @artskidesign!