fix(oauth): tolerate unexpected token fields when loading saved oauth.json (#932)

Saved OAuth token files may contain fields the strict Token dataclass
does not accept -- notably refresh_token_expires_in, which Google added
to the device-flow response. #927 fixed this for prompt_for_token when
the device flow first runs, but YTMusic.__init__ still splats
_auth_headers into RefreshingToken(...), so the same TypeError
reappears every time such a file is loaded.

Filter _auth_headers to Token.members() before unpacking. Mirrors #927's
approach. Forward-compatible: any future field Google adds is silently
dropped instead of crashing.

Fixes #921.

Co-authored-by: terminalcommand <13887313+terminalcommand@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: sigma67 <sigma67.github@gmail.com>