fix: issue with refreshing token when client_secret is not set

[anna-romanova]

Fix for #506

Problem: The support for PKCE (Proof Key for Code Exchange) was introduced in the library, making the client_secret field optional (see commit e6afdfb). However, the client_secret field is still included in the list of validated fields in the refresh() method (Service.js#L667).

Issue: When creating a client without setting a client_secret (using PKCE for authentication), the token cannot be refreshed after its default expiration of one hour. This is because the validation check in the refresh() method expects a client_secret, causing an error in the PKCE flow.

Proposed Fix: Adjust the validation logic in the refresh() method to account for the possibility that the client_secret is not provided when using PKCE. This ensures that the token can still be refreshed in the absence of a client_secret.

[anna-romanova]

Hi @jpoehnelt 👋,

Just a friendly ping — we’re encountering an issue with refreshing the token when using PKCE without setting a client secret. Resolving this in the OAuth2 for Apps Script would be the best solution for us, and I was wondering if you might have some time to look into the proposed changes in this PR.

Any feedback or thoughts would be greatly appreciated! Thanks so much for your time and help.