This moves the currently hardcoded `getAccessTokenResponse` into their own method.  This allows children providers to construct their own headers as needed.

A perfect example of the necessity of this feature is the newer Pinterest v5 API.  In order to exchange the code for an access token, they require an `Authorization` header composed of a base64 encoded `client_id` and `client_secret`.  Without this change, the Pinterest Provider would need to entirely reimplement the `getAccessTokenResponse` method.  **With** this change, the Pinterest Provider could simply:

```php
protected function getTokenHeaders()
{
    return array_merge(
        parent::getTokenHeaders(),
        [
            'Authorization' => 'Basic ' . base64_encode("{$this->clientId}:{$this->clientSecret}"),
        ]
    );
}
```