Update OAuth instructions to use curl to get refresh token

[thena-seer-sfg]

Description of change

The current instructions are incorrect. The code received in the redirect url is not a refresh token, and the tap fails when it tries to use it as one. In order to get a refresh token, there is a code exchange step. The easiest way to do this is using curl, so I've added this step to the instructions.

This is based on Harvest's documentation: https://help.getharvest.com/api-v2/authentication-api/authentication/authentication/#oauth2-authorization-flow

Manual QA steps

• Follow the instructions, verify they work.

Risks

• Just a README change, risk is misinformation

Rollback steps

• revert this branch

AI generated code

https://internal.qlik.dev/general/ways-of-working/code-reviews/#guidelines-for-ai-generated-code

• this PR has been written with the help of GitHub Copilot or another generative AI tool

[singer-bot]

Hi @thena-seer-sfg, thanks for your contribution!

In order for us to evaluate and accept your PR, we ask that you sign a contribution license agreement. It's all electronic and will take just minutes.

[singer-bot]

You did it @thena-seer-sfg!

Thank you for signing the Singer Contribution License Agreement.