Security Authentication handlers should not reference JwtSecurityToken

### Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is.
Example: I am trying to do [...] but [...]

### Describe the solution you'd like

Asp.net uses ISecurityTokenValidator.ValidateToken which has an out parameter of type SecurityToken. asp.net assumes a JwtSecurityToken.
If a user plugs in a different ISecurityTokenValidator that returns a different valid token that represents a JWT, this will fail.

[Here for OIDC](https://github.com/dotnet/aspnetcore/blob/62351067ff4c1401556725b401478e648b66acdc/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L1178)

[also here (there are others)](https://github.com/dotnet/aspnetcore/blob/62351067ff4c1401556725b401478e648b66acdc/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L545)

asp.net and IdentityModel will need to work together to develop the correct JWT abstractions so new token validators, handlers and tokens can be used.

see: IdentityModel https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1349

### Additional context
Add any other context or screenshots about the feature request here.