fix: propagate xsec token for sub-comments

[RuochenLyu]

Summary

• add an optional --xsec-token flag to xhs sub-comments
• forward the token to get_sub_comments
• include the browser query parameters image_formats, top_comment_id, and xsec_token
• cover both the client request parameters and CLI argument propagation with unit tests

Root cause

The sub-comment endpoint only sent note_id, root_comment_id, num, and cursor. The current web request also includes the note's xsec_token and stable image/top-comment parameters. Without the token, accessible reply threads can be misclassified as verification failures.

The new argument is optional and appended to the Python method signature, so existing API and CLI calls remain compatible.

Example using synthetic values:

xhs sub-comments note-123 comment-456 --xsec-token synthetic-token --json

Tests

• uv run ruff check .
• uv run python -m pytest -q --ignore=tests/test_integration.py (116 passed, 11 deselected)
• uv build

Related to #14.