specs/xrpc: service token with identifier in iss

[bnewbold]

Adds details about how to use service-specific signing keys in inter-service auth JWTs.

I also walked back the "this is temporary" language a bit. We might expand to other token types in the future, but this JWT mechanism probably isn't going away for a while.