Clarify default nbf validation behavior in documentation

[tatianahub]

Clarify the documentation around nbf validation behavior.

While reading the README, I understood that nbf is automatically validated whenever it is present. However, after checking the Validation defaults, I found that nbf validation is disabled by default (validate_nbf = false).

This update makes the documentation explicit:

• exp is validated by default.
• nbf validation is supported but must be enabled explicitly.

This avoids possible confusion for users relying on the default Validation configuration.