Don't require `TokenVerifier` to know the format of tokens

Currently, the TokenVerifier is returning a SignedJWT when verified.

This doesn't make sense, though, as only the current implementation is using JWTs.

This instead uses a TokenAdapter class which provides a mapping from the current implementation (JWTs) and a generic type that can be used elsewhere.

This has the benefit of making our TokenService really nice and implementation-agnostic, which is what we want!