Simplify JWT validation

[markhobson]

We currently validate the JWT access token using Authlib's JOSE to decode and validate claims.

Authlib also provides JWTBearerTokenValidator that can perform both of these functions against a more rigorous set of constraints. It is typically used to protect resources in a framework-specific manner, so we would ideally need a FastAPI resource protector implementation.