Enhancement: Provide more information in the result from the UserManager.Verify*TokenAsync() methods

Hi there,

As an enhancement, I'd like to see more information returned from the Verify*Token methods on UserManager, such that richer information on failures can be recorded in metrics, or the flow updated to ease user interactions.

Rather than returning a boolean true/false from UserManager.verifyUserToken(), I'd be interested in a richer object that's a pair of true/false + some sort of status string / error code / something to provide more details.

I think there'll only be one token provider for any given call, so it shouldn't need to have multiple status strings returned (eg, if multiple providers needed to say 'no' in different ways)

The sort of failure information we could see passed back would allow:

- Being able to find out if the TOTP code is ahead/behind but nearly valid (user may need to be pushed to a flow to obtain multiple codes to handle authentication token resync)
- An one-use token was valid but already been used (please ask for another or contact an admin to investigate if you didn't use it)
- A time-limited token was valid but has timed out (ask for another token)

And additionally we would start storing metrics on the above, so we can see if the time delay on tokens is too short; if there's something confusing in the flows, or if some odd spike of failures is indicating an attacker trying it on.

For those providing public signups, exposing the exact details of the failure to the users may have a security impact, so I wouldn't make displaying information part of any templates.

In a corporate environment, re-sending a expired code to a phone automatically (rather than require the user to re-start the password reset flow) could reduce the support load of these sorts of security features.

Hopefully that makes sense,
Michael