Use CancellationTokenSource instead of casting dummy objects

[robertbrignull]

In a few cases in the tests we need either a CancellationToken or CancellationTokenSource and we're building a minimal object and then forcibly casting it to the right type. Using CancellationTokenSource is not hard so I see no reason we shouldn't use the real class in all of these cases.

Checklist

• CHANGELOG.md has been updated to incorporate all user visible changes made by this pull request.
• Issues have been created for any UI or other user-facing changes made by this pull request.
• [Maintainers only] If this pull request makes user-facing changes that require documentation changes, open a corresponding docs pull request in the github/codeql repo and add the ready-for-doc-review label there.