A few bugs in the Oauth Flow

[tunjid]

Hi! Thanks again for the library. When trying to use the oath flow, I noticed a few bugs that I had to patch locally. I can upstream them here if you want, but its a bit of a refactor. They're listed below.

• The OauthApi in the AuthenticatedXrpcBlueskyApi shares the same HttpClient as the AuthPlugin. This causes circular loops for oauth flows when use_dpop_nonce is present in response headers.
• The OauthApi cannot parse the AtpException json response bc it's private json requires explicitNulls. It should probably inherit content negotiation from the HttpClient passed to it, and not set its own.
• The error response header when an oauth token lapses seems to be invalid_token not ExpiredToken.

I ended up going with an explicit SessionManager to separate a few concerns.

[christiandeange]

Thanks for reporting! I think the second and third bullet points are fairly straightforward for me to address, but can you elaborate on the repro steps for the first one?