Clarify properties in access token grant response description and example

https://indieauth.spec.indieweb.org/#access-token-response states that the following properties must/should/may be present in access token grant responses:

* access_token (required)
* me (required)
* profile (optional)
* expires_in (recommended)
* refresh_token (optional)

The example additionally includes `token_type` and `scope`. Some applications (e.g. Quill) require scope, and the fact that scopeless token requests are invalid implies that scope might be required.

Pending clarification, I’d suggest the following changes:

* Update the list of possible properties in the access token response, including all required properties and noting all commonly used optional/recommended properties, linking to relevant specifications which reference them as with refresh_token
* Clarify in the text whether it’s permitted to include additional properties in the response, and under which circumstances
* Provide two examples, one of a minimal response containing only the absolutely required properties, and another with a variety of optional properties

Relevant conversation: https://chat.indieweb.org/dev/2022-09-19#t1663626755838500

Start with the access-token-response section of the IndieAuth specification and review the linked IndieWeb chat conversation for the unresolved property requirements. Update the property list and guidance for additional fields, then provide minimal and expanded response examples whose required and optional fields match the clarified rules.

Written by the indexing model from the issue text.