[core] Tokens in braces which aren't recognised by mapbox are removed from URLs

[bfrengley]

Platform: iOS and Android (confirmed--expected to affect all supported platforms)
Mapbox SDK version: iOS: 3.7.6, 4.0.0

Steps to trigger behavior

1. Add a source with a tile URL containing tokens in braces that mapbox doesn't handle (e.g., "http://example.xyz/tile/{z}/{x}/{y}.mvt?{auth}&otherparam=value")
2. Register a delegate to transform the URLs from that source, which does the following:
   1. Attempts to replace the "{auth}" token with a value (e.g., "auth_token=54cd8101-a4dc-4f09-89e9-f4f0eb479e44")
   2. Returns the transformed URL
3. Attempt to load a tile from the source

Expected behavior

Returned URL will contain the expected auth query parameter (e.g., "http://example.xyz/tile/1/0/0.mvt?auth_token=54cd8101-a4dc-4f09-89e9-f4f0eb479e44&otherparam=value"

Actual behavior

No {auth} token is present in the URL which is passed into the URL transformation delegate (e.g., "http://example.xyz/tile/1/0/0.mvt?&otherparam=value")

---

This occurs because every token in braces is replaced with some string indiscriminately by util::replaceTokens, and that string is empty when the token is unknown.

This behaviour is inconsistent with mapbox-gl-js, where unknown tokens still exist in the URL passed into the transformation function, as mapbox-gl-js explicitly replaces only those it recognises.

[jfirebaugh]

@bfrengley Thank you so much for the detailed and comprehensive description! Reports like this are a pleasure to resolve.