Provide a decoupled way to get the one time login token

Attached a patch which provides the functionality.

It adds a submodule, jsonapi_user_resources_one_time_login.

It essentially provides a token, with the same logic of the user module, but without building the entire Drupal's reset password route url.

It also add an alternative to the code user reset_password mail, where is possible to use the token as a partial data of a front-end url.
I went with this implementation because there's is not (or at least I couldn't find) good hook\event to use to insert (or replace) the new token in the standard email. user_mail_tokens() is a good starting point to check that.

I had to to remove the final from PasswordResetSubscriber in order to decorate it in the submodule.