Provide a core utility method for generating a JWT.
We don't necessarily have to centralize this (OAuth 2 JWT generation happens many layers deep in third-party code, so probably that won't be updated to use the new mechanism), but for T399200: Update existing cookie-based sessions to include JWT cookie we'll need to generate JWTs either in core or in CentralAuth, and then core seems nicer since we are kind of trying to standardize JWT-based sessions.
We'll need to pick a JWT library (probably lcobucci/jwt since it's one of the most popular PHP JWT libraries and we already use it in OAuth 2, but if we really want to reconsider that choice, we could), add it to vendor, and provide a wrapper mechanism somewhere in the session component. That could be minimal (just a generic wrapper so we can more easily swap the underlying implementation) or it could be more opinionated about the JWT format (automatically invoke the new method defined in T399198: Define standard JWT session data for supported session types, take a User and handle the formatting of the sub field etc).
