box_token_manager: add downscoped access token support with resource sent in the request body

Problem/Motivation

The box_token_manager submodule (8.x-1.1) can mint and refresh a
Box system access token, but it has no way to derive a
downscoped token — a token restricted to a narrower set of
scopes and/or to a single Box resource (e.g. a specific folder). Box supports
this through an RFC 8693 token exchange, where the caller sends the parent
token plus a resource parameter and receives a token limited to that
resource.

Consumers that only need to act on one folder are therefore forced to reuse the
broad system token, which is a larger blast radius than necessary. There is no
public API on the token manager to request a scope- or resource-limited token.

A common pitfall when implementing this is that the resource value
must travel in the token-exchange POST body. If it is placed
anywhere else (for example a side "data" array that the HTTP client never
serialises into the body), Box silently ignores it and returns a token that is
not scoped to the resource — defeating the purpose of downscoping.

Proposed resolution

Add a Box-specific token manager that exposes a downscoped-token API and
guarantees the exchange parameters reach the request body: