Feature request: Replace jsonwebtoken library with the more modern jose.

**Is your feature request related to a problem? Please describe.**
As per #2434, jsonwebtoken is causing problems as it is not really suitable for in browser use, and suffers from lack of maintenance.

As part of the fix for #2434 the JWT Sign operation has switched to using the jose library instead. This should now be applied to the remaining places where jsonwebtoken is used (JWT Verify and JWT Decode).

**Describe the solution you'd like**
Remaining uses of jsonwebtoken be replaced by use of jose, and the jsonwebtoken dependency removed form the project.

**Describe alternatives you've considered**
A web search for jsonwebtoken replacements pointed to jose as the most popular candidate.

jsonwebtoken is not really an option for us any more as the 9.X version simply doesn't work correctly in the browser, and the 8.5.X version has a High level CVE.

Use issue #2434 and the existing JWT Sign change as the starting points. Locate the remaining JWT Verify and JWT Decode uses, then trace the jsonwebtoken dependency through the project. Done means those operations use jose and the jsonwebtoken dependency is removed without breaking browser use.

Written by the indexing model from the issue text.