Surface OAuth2 error detail on token refresh (#420)

[AndreyVMarkelov]

What

• raise_dropbox_error_for_resp: on a 400 from /oauth2/token, drop the redundant request_id re-fetch so refresh failures surface the server's error (e.g. invalid_client) as a BadInputError instead of an opaque 400. Fixes the confusion in Problem with refreshing token #420.
• Integration: add test_refresh_failure_error_detail — a wrong app secret must raise BadInputError carrying invalid_client.
• Integration: derive the user client from the refresh token instead of a stored access token (port of Derive integration test access token from refresh token dropbox-sdk-dotnet#395). Access tokens are short-lived and were the recurring cause of CI auth flakiness; refresh tokens don't expire. Removes SCOPED_USER_DROPBOX_TOKEN from the required credentials and from ci.yml/coverage.yml.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.19%. Comparing base (27eecf8) to head (88e693c).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #544      +/-   ##
==========================================
- Coverage   65.19%   65.19%   -0.01%     
==========================================
  Files          34       34              
  Lines       65206    65205       -1     
  Branches     4642     4642              
==========================================
- Hits        42509    42508       -1     
  Misses      22536    22536              
  Partials      161      161              

Flag	Coverage Δ
integration	65.04% <ø> (+0.01%)	⬆️
unit	64.80% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.