Bazel credential helper now refreshes tokens ahead of the expiry boundary

The Bazel credential-helper for Tuist now proactively refreshes the user’s short-lived access token within a 60-second safety margin of its expiry, and reports the credential-helper expires value brought forward by the same margin. Long Bazel remote cache builds against Tuist/Kura no longer suffer clustered UNAUTHENTICATED waves around the JWT’s TTL boundary, which previously caused mid-build Read and Write bursts of server rejections.