Sanitize `TokenValidationError`

[sirewix]

TokenValidationError::TokenDecodeError returns josekit::JoseError which has lots of anyhow::Error under the hood. We need to make sure that returned errors do not return any sensitive information and TokenValidationError can be safely logged and returned in json response

[sirewix]

It would also be great if there would be an easy way to distinguish among user facing errors ("missing claim", "invalid signature") and "very likely errors on our end" like "invalid jwk format", this way services can correctly return 4xx or 5xx