Consider adding SessionId to TokenCreationRequest

[brockallen]

This would be a non-trivial change, but it allows a formal location for indicating session id when tokens are created. Currently, the session id is inferred from the validated request object. but that's not where it will be in all workflows. So the long term solution to https://github.com/DuendeSoftware/Support/issues/99.