RefreshAuthTokenAsync requires a client secret, but Device Code Flow auth doesn't use one for public clients

[chrishayesmu]

Requiring a client secret is consistent with the Twitch documentation for refreshing tokens, but the documentation is also wrong; see this docs issue.

When performing device code grant flow with a public client, there is no client secret in use. The DCF-specific docs state that public clients "can refresh an access token without passing a client secret". This turns out to be true in practice; public clients can indeed omit the client_secret parameter when calling the refresh API.

Since RefreshAuthTokenAsync follows the specification of the former (mistaken) Twitch docs, it is unusable for refreshing DCF tokens for public clients. It's not too hard to just make the call without TwitchLib, though it is confusing.