Drop support for the legacy password placeholder for OAuth tokens

[yihanzhen]

This change is not backward-compatible (although #58 wasn't either :() so we will prepare for 4.0.0 for next release.

Drop support for the legacy password placeholder to refresh OAuth tokens for. It has been harder and harder to maintain two different templates.

Also:

• remove the positional argument and use strict commands and options so that the tool will error if input is not correct.
• bump npm version in CI checks to the current LTS versions (16, 18, 20: https://endoflife.date/nodejs)