Add Token Status List reference as issuer-side revocation alternative (#2258)