specs: update service auth and session auth JWT docs with updates

[bnewbold]

Ref: https://github.com/bluesky-social/atproto/pull/2743

• iat in service auth (token created at)
• typ header field distinguishes between at+jwt ("access token") and refresh+jwt (refresh)

[matthieusieben]

Also: typ of service auth would be set to JWT