Bazel credential-helper refreshes tokens before expiry

The tuist bazel credential-helper now proactively refreshes user access tokens and reports an earlier expiry when a token is within 60 seconds of expiration. This eliminates mid-build waves of UNAUTHENTICATED errors during long remote-cache Bazel builds.