[smilkuri]

Description

• This PR updates CredentialProvider::memoize() to implement the shared credential refresh lifecycle. When a recoverable refresh fails, the SDK keeps using the last successful credentials and waits before contacting the credential source again. This behavior improves resilience to temporary credential source outages by allowing requests to continue reaching the service instead of failing immediately during client-side credential refresh.

• The PR also calculates refresh timing from credential lifetime and classifies provider errors that require customer action as non-recoverable.

Behavior changes

• The SDK now uses two refresh windows, advisory window of 5, 15, or 60 minutes based on credential lifetime.
  and mandatory window of 60 seconds.
• Login credential provider refresh window is updated from 3min to 5min.
• AssumeRoleWithWebIdentity no longer retries InvalidIdentityToken within the provider.
• IMDS no longer extends credential expiration after a failed refresh. The shared lifecycle manages static stability.
• When a CacheInterface is configured, the public cache() wrapper returned stored credentials until they expired. Refreshes in the advisory and mandatory windows never reached the credential source, and expired creds were dropped. Both conflict with the spec, which requires refreshing inside those windows and never discarding cached credentials after a failed refresh.
• The default chain now uses a private cacheCredentials() wrapper for in-scope providers. It reads stored credentials once to start the lifecycle, sends later refreshes to the credential source, and keeps the last successful credentials when a refresh fails. Process credentials and the public cache() method keep their existing behavior.

Not in Scope

• The spec requires invalidating cached credentials and retrying the request when a service returns ExpiredToken or ExpiredTokenException. This is not implemented because memoize() keeps its state in a closure with no second operation for the request pipeline to call. Adding it would require memoize() to return an object and new middleware, which changes long-standing public behavior. Credentials are refreshed through the expiration-based windows instead.
• Automatic lifecycle for directly configured providers. The spec applies the lifecycle to in-scope providers created outside the default chain. In this PR, a provider passed directly to a client for example 'credentials' => CredentialProvider::instanceProfile() must still be wrapped in CredentialProvider::memoize(), as the current docs describe. Automatic wrapping at the client boundary is not in scope for this.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[stobrien89]

Suggested change

	{
	}
	interface NonRecoverableCredentialsExceptionInterface extends \Throwable {}

[stobrien89]

Can we rename and format like this:

Suggested change

	class NoCredentialsError extends CredentialsException
	{
	}
	class NoCredentialsException extends CredentialsException {}

[stobrien89]

Can these tests be moved into CredentialProviderTest?

[stobrien89]

generally we like to keep test classes per each runtime class

[stobrien89]

can we move this and ScriptedSourceClosure into a Utils sub-namespace/directory?

[stobrien89]

these helper closures are recreated on every temporary-credential lookup including the cached path- could we move the fast path before their construction? Where possible, let's make consolidate and extract some of these closures to private static methods