WPCOM: update blog auth url args

- s/blog/blog_id/ (needed for WPCC)
- allow additional args like `state`
OAUTH_ACCESS_TOKEN_ENDPOINT is a class const
Cast headers as array before looping through

Prevents notice if we get an empty set.
Fix incorrectly referenced var in send_request
WP_REST_Request expects the full URL

Not the URL and path which is what we were passing for fetching access token
3rd param for WP_REST_Request is post data
WP_REST_Transport_Curl should use handle_success

For consistency.