Thank you so much for that @claudiunicolaa .
How do I go about telling Keycloak to use the new extension instead of the default ExecuteActionsActionTokenHandler? Do I need to also extend the DefaultActionToken like it does here? Server Developer Guide
Edit: Please check out my question here for the solution → Custom SPI - Link for user to set their initial password