Fix thumbnail token query parameter

[ssylvia]

Fixes: #1314

Private item thumbnail URLs were appending the raw token as the query string, producing unauthorized requests. ArcGIS expects the token under the token query parameter.

• Thumbnail URL decoration

  • Changed private thumbnail URLs from ?${token} to ?token=${token}.
  • Preserved public thumbnail behavior with no token appended.

• Test coverage

  • Added direct decorateThumbnail() coverage for private and public thumbnail URLs.
  • Updated authenticated getItem() thumbnail expectations.

thumbnailUrl += `?token=${token}`;

[patrickarlt]

LGTM! Thanks @ssylvia I'm going to merge.