Bazel credential-helper refreshes the access token before its expiry boundary

For Bazel remote-cache builds against Kura, the tuist bazel credential-helper now refreshes the user’s access token proactively within a 60-second safety margin of expiry and reports expires 60 seconds earlier than the JWT exp, so Bazel reloads the helper before the boundary. Bazel otherwise reuses the cached credential right up to its reported expiry, and in-flight RPCs around the 10-minute boundary were getting UNAUTHENTICATED burst rejections. Project tokens (no expiry) and account tokens (cannot be refreshed) are reported unchanged, and a failed proactive refresh falls back to the existing token instead of failing the build.