Expose additional BoxAPIRequest/BoxAPIConnection members for request intercept use case

In a Box SDK integration, I implemented a `com.box.sdk.RequestInterceptor` that uses its own HTTP client to send the requests over the network. Doing that, I noticed that in order to support this scenario, certain members should, in my opinion, be exposed to clients outside the SDK:
- `com.box.sdk.BoxAPIRequest.getHeaders()` should be public so that the corresponding content is accessible
- `com.box.sdk.BoxAPIRequest.shouldAuthenticate` should be exposed via a getter to distinguish the two cases that it indicates

In order to hold a read lock on the access token during the request (as `com.box.sdk.BoxAPIRequest.trySend(ProgressListener)` does), it would be necessary to also expose
- `com.box.sdk.BoxAPIConnection.lockAccessToken()` and
- `com.box.sdk.BoxAPIConnection.unlockAccessToken()`.

The access token can be obtained with the (already public) method `com.box.sdk.BoxAPIConnection.getAccessToken()`, but in this case there is no lock and the access token could be invalidated before the HTTP request is sent (or while it is being sent).

Locate the BoxAPIRequest and BoxAPIConnection declarations, then read BoxAPIRequest.trySend(ProgressListener), getHeaders(), and the existing access-token handling. Confirm how the interceptor needs to distinguish authentication and preserve the access-token lock; done means the requested members are externally accessible without breaking the existing request behavior.

Written by the indexing model from the issue text.