Keep Bazel remote cache authenticated across token expiry

The tuist bazel credential helper now proactively refreshes a user’s access token once it is within a 60-second safety margin of expiring, and reports expires brought forward by the same margin. Bazel then reloads the helper about a minute before the real expiry, so long remote-cache builds no longer burst with UNAUTHENTICATED errors on the 10-minute JWT TTL boundary. Project tokens (no expiry) and account tokens (cannot be refreshed) are reported unchanged, and a transient refresh failure falls back to the still-valid token.