Auth token memoized to avoid per-op keychain reads

The auth token resolution path is now memoized process-wide in ServerAuthenticationController, bounded by the token’s own expiry and using the existing single-flight CachedValueStore. The CAS compilation-cache daemon (and every other auth caller) no longer performs a keychain read via securityd on every artifact request; in isolation 300 concurrent authentications now do one underlying read instead of 300, removing a major source of CAS latency on hosted macOS runners.