Add refresh token support as an opt-in feature

[hpsin]

GitHub recently released refresh token support for oauth apps: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#expiring-access-tokens

This will allow a client to opt in to requesting expiring tokens and refresh tokens, which helps improve secirity.

We should add refresh token support to both the device flow and web app flow. For now it can be disabled by default, but can be opted into by the client using the library. If opted into, we need to:

1. Send the offline_access scope during the initial request
2. Catch the refresh token in the token response as well as the expiration times, and store them appropriately like the access token. Importantly: if no refresh token is returned, assume that the server doesn't support them and fall back to unexpiring token behavior.
3. When calling APIs, if the token is rejected attempt to refresh the token once and try again, before failing hard. We don't want to accidentally create an infinite loop of call, fail, refresh, loop.

I'll get this kicked off with an agent to get a sketch of what this would look like, and get feedback on best practices.

Thanks!