Add a middleware handler to de-reference opaque access token to JWT

[stevehu]

We have customers that are concerned to send JWT token to the Internet as it might reveal PII and there is no way that you can revoke a JWT token. The solution is to send a by-reference token to the outside and then de-reference it once the request enters into the DMZ on BFF. We need to build a handler to do this job before JwtVerifyHandler in the chain. Or simply replace the JwtVerifyHandler with this one on the BFF instance.