Fix new_token() and remove session auth from client

[malachy-mcconnell]

The important change is to remove the lines

    opts[:username] = client.user
    opts[:password] = client.password

from token.rb::new_token() because client never needs nor wants to know username and password now that session auth is deprecated.

We may as well remove all the session references from client as they can no longer have any effect.

Note that new_token needs to be called like this, for example

          token = client.new_token(
            name: @name,
            services: @use_version.service_id,
            scope: 'purge_all purge_select',
            username: username,
            password: password,
          )

Which is as expected given the docs example: https://developer.fastly.com/reference/api/auth/#create-token

[malachy-mcconnell]

Needs tests modified but please comment on the approach first.

[Integralist]

Closing this pull request now we've published v4.0.0