Take sync message timestamp into account for QR tokens

[link2xt]

At least for syncing QR code tokens over sync messages, they get a timestamp that is not the same as the sync message timestamp, but the time of reception of the sync message. Then with #7176 merged when we receive a sync message to remove tokens, we remove tokens that may be even newer than the sync message and this is not good.

I think this is doable without introducing any wire format change, we already have a timestamp on the sync message itself (the Date header, it is protected), it only has to be passed into the functions that process the messages. EDIT: turns out sync items already have explicit timestamp, it was just not used.

Also for expiring auth tokens in #7116, they are currently considered fresh after syncing and should actually be expired if sync message is old.