Bazel credential-helper refreshes ahead of token expiry

Long Bazel remote-cache builds against the Tuist/Kura cache no longer hit mid-build bursts of UNAUTHENTICATED errors when short-lived access tokens cross expiry. The credential helper proactively refreshes within a 60-second safety margin and reports expires 60 seconds early so Bazel rotates before the boundary; project tokens (no expiry) and account tokens (can’t be refreshed) are reported unchanged.