Refactor/combine /token and /refreshtoken endpoints

Overview

There are currently separate endpoints for obtaining an access token and obtaining a refresh token. Since these two tokens will go hand-in-hand, it will simplify things if the two endpoints were combined. At the same time, part of the proposal coming out of FOLIO-2523 is to move towards a more standard API for authorization. This API should follow suit and move away from custom HTTP headers when appropriate.

See the wiki for details

Acceptance Criteria

• TBD - depends on whether this is being implemented against the existing codebase, or a new codebase (rewrite or mod-authtoken)