decorateThumbnail token not applied correctly

[Jon-Paez]

Describe the bug

Decorate thumbnail funciton in @esri/arcgis-rest-portalappends ?${token} instead of ?token=${token} leading to 403 errors on private items.

export function decorateThumbnail(item, portal, token) {
    if (!item)
        return item;
    let thumbnailUrl = null;
    if (typeof item.thumbnail === "string") {
        thumbnailUrl = `${portal}/content/items/${item.id}/info/${item.thumbnail}`;
        if (thumbnailUrl && item.access !== "public" && token) {
            thumbnailUrl += `?${token}`;
            // thumbnailUrl += `?token=${token}`
        }
    }
    return Object.assign(Object.assign({}, item), (thumbnailUrl ? { thumbnailUrl } : {}));
}

Reproduction

We see this when duplicating item clean up in ArcGIS Storymaps, you can see our error toasts and a logged 403 in the network tab.

Logs

System Info

"@esri/arcgis-rest-portal": "^4.10.2",
"@esri/arcgis-rest-request": "^4.10.2",

Additional Information

No response