Bazel credential-helper refreshes before the token expiry boundary

The tuist bazel credential-helper now refreshes the user’s access token proactively when it is within 60 seconds of expiring and reports the helper’s expires field 60 seconds ahead of the real JWT expiry. Bazel’s CredentialCacheExpiry then reloads the helper ahead of the boundary and rotates to a freshly refreshed token, so long Bazel builds against the Tuist/Kura remote cache no longer hit mid-build waves of UNAUTHENTICATED on Read or Write operations right at the 10-minute token expiry. Project tokens (no expiry) and account tokens (cannot be refreshed) are reported unchanged, and the refresh is best-effort.