Add refresh token support as an opt-in feature

GitHub recently released refresh token support for oauth apps: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#expiring-access-tokens

This will allow a client to opt in to requesting expiring tokens and refresh tokens, which helps improve secirity.

We should add refresh token support to both the device flow and web app flow. For now it can be disabled by default, but can be opted into by the client using the library. If opted into, we need to:
1. Send the offline_access scope during the initial request
2. Catch the refresh token in the token response as well as the expiration times, and store them appropriately like the access token. Importantly: if no refresh token is returned, assume that the server doesn't support them and fall back to unexpiring token behavior.
3. When calling APIs, if the token is rejected attempt to refresh the token _once_ and try again, before failing hard. We don't want to accidentally create an infinite loop of call, fail, refresh, loop.

I'll get this kicked off with an agent to get a sketch of what this would look like, and get feedback on best practices.

Thanks!

Start by reading the library’s device-flow and web-app-flow implementations, along with how API calls handle rejected tokens. Check how initial scopes and token responses are currently processed. Done means clients can opt in to refresh tokens in both flows, unsupported refresh tokens retain existing unexpiring-token behavior, and a rejected token is refreshed and retried at most once.

Written by the indexing model from the issue text.