Refresh OIDC tokens in Galaxy

once obtained during login, OIDC tokens are never refreshed. We should change this, otherwise we have to refresh tokens down the pipeline, e.g. from a tool. This might still be needed if there is a large time interval between last refresh and the moment we need to use the token (e.g. after a long job is finished and we want to upload output to distributed storage, or the job is queued for long time and we cannot do ssh anymore)