Long Bazel builds no longer hit UNAUTHENTICATED errors at token expiry

The tuist bazel credential-helper now refreshes refreshable user access tokens and reports expires 60 seconds before the real JWT expiry. This prevents Bazel from continuing to attach a token to in-flight remote-cache requests right up to the boundary, which caused bursts of UNAUTHENTICATED errors during long builds against the Tuist/Kura remote cache.