[CXF-5944] Moving some of security utils to the core where they might stay and working toward preparing creating a JOSE module without the deps on the OAuth2 module, the idea from Luigio