Fix/refresh token optional

[thomasconner]

What kind of change does this PR introduce?

Bug fix - Supabase client will ignore autoRefreshToken setting when setting a session with an expired access token
Breaking Change - Session type now has refresh_token as optional

What is the current behavior?

When a Supabase client is initialized with auto refresh token disabled

const client = createClient(options.supabaseUrl, options.supabaseKey, {
    auth: { autoRefreshToken: false }
});

but a session is set with client.setSession() and the access token is determined to be expired the client will disregard the autoRefreshToken setting and attempt to refresh the token.

What is the new behavior?

The client will abide by the autoRefreshToken setting and not refresh a session if auto refresh token is disabled and the access token provided when setting the session has expired.