fix: form encode revoked refresh tokens

[ryanduguid]

Summary

• URL-form-encode the refresh token when constructing the OAuth revocation request
• add a regression test covering +, &, and = in an opaque token value

Without encoding, a legal opaque token such as refresh+token&part=value is interpreted as multiple form fields rather than the value of the token parameter.

Validation

• git diff --check
• static request-body contract check

The environment has no Java, javac, Maven, Gradle, or Maven wrapper, so I could not execute the added JUnit test locally. It is intended to run with mvn -Dtest=ApiClientTest test, followed by the full Maven suite.