[3.1.1 backport] JWTLastUpdated should only be modified when claim-based access changes

authenticateJWTIdentity is setting JWTLastUpdated to time.Now() every time a JWT is used for authentication. This triggers an update to the principal document in updatePrincipal, which results in unintended sequence allocation and user doc mutation per authentication.

JWTLastUpdated should only be updated when one of the other JWT-related properties is modified on the principal.