[Task] Add automatic GitHub App token refresh to the Copilot SDK

[gfarb]

Outcome

Long-running SDK sessions can refresh GitHub App credentials without restarting the session or forcing repeated OAuth flows.

Scope

• Add a supported credential-provider mechanism for lazy or proactive refresh
• Support S2S installation token re-minting before or after the one-hour expiry
• Support U2S refresh tokens and discoverable token lifetime policies
• Retry safely when a token expires during a turn
• Replace reliance on the experimental session.auth.setCredentials workaround
• Preserve existing static token behavior

Acceptance criteria

• A session running longer than one S2S token lifetime continues without manual token injection
• A request encountering token expiry can obtain a fresh credential and retry without duplicating unsafe work
• U2S refresh does not force a new interactive OAuth flow on normal expiry
• Refresh failures surface clearly and never silently fall back to another identity
• Node, Go, .NET, and Java SDK behavior is consistent or explicitly staged
• Public SDK documentation includes secure private-key and refresh guidance

Dependencies

Coordinate runtime credential update behavior with the bundled CLI. The basic gitHubToken acceptance fix remains tracked in github/copilot#30423.

References

• Parent epic https://github.com/github/copilot/issues/30409
• ADR https://github.com/github/copilot/pull/30449
• Existing prior art Add getBearerToken callback for BYOK providers (Managed Identity) #1748