fix: optional scopes in refresh token

[monsignore7]

Description

This fix proposes the introduction of a new attribute of the UserManagerSettings class that would be used during the flow of refresh token to decide whether or not to include the scopes as param in the body of the request.
This fix is needed, as I pointed out in #167, because Salesforce doesn't support scope parameter in the body request when refreshing token.

Type of Change

• ✨ New feature (non-breaking change which adds functionality)
• 🛠️ Bug fix (non-breaking change which fixes an issue)
• ❌ Breaking change (fix or feature that would cause existing functionality to change)
• 🧹 Code refactor
• ✅ Build configuration change
• 📝 Documentation
• 🗑️ Chore

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.

Project coverage is 21.22%. Comparing base (3227179) to head (de5fda5).
Report is 14 commits behind head on main.

Files with missing lines	Patch %	Lines
.../oidc_core/lib/src/managers/user_manager_base.dart	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #169      +/-   ##
==========================================
- Coverage   21.28%   21.22%   -0.06%     
==========================================
  Files          63       62       -1     
  Lines        1809     1809              
==========================================
- Hits          385      384       -1     
- Misses       1424     1425       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ahmednfwela]

while this solves the specific issue of removing scope from refresh token, I think we need a more general solution for modifying the requests before sending them for any other use case that pops up

[monsignore7]

I think that is a little bit difficult to manage these issues in a more generic way, because every idp can manage the optional parameters of the different endpoints in different ways.
Moreover, in this specific case, refresh token api could be called in automatic by the OidcManager, so the only way the end user can manage the parameters is during the creation of the manager.

[stonymahony]

That would of course be even better, I agree with you @ahmednfwela. But that's time-consuming and takes quite a while, right?
Since the current behaviour leads to errors for some OIDC providers, I would consider this an urgent, important fix that therefore should be merged.