token replacement doesn't pass in BubbleableMetadata; resulting cache data gets applied to entire page

The documentation for Token::replace() says:

   *   To ensure that the metadata associated with the token replacements gets
   *   attached to the same render array that contains the token-replaced text,
   *   callers of this method are encouraged to pass in a BubbleableMetadata
   *   object and apply it to the corresponding render array. For example:
   *   @code
   *     $bubbleable_metadata = new BubbleableMetadata();
   *     $build['#markup'] = $token_service->replace('Tokens: [node:nid] [current-user:uid]', ['node' => $node], [], $bubbleable_metadata);
   *     $bubbleable_metadata->applyTo($build);
   *   @endcode

The call to Token::replace() should do this and set the metadata on the returned build array.

Furthermore, if the result of the token replacement means that the rendered field item is uncacheable (because it depends on the user or the session), then a lazy builder should be used to prevent the whole page from being uncacheable.