TokenCredential.supports_caching

[chlowell]

Part of #19308. Today, BearerTokenCredentialPolicy caches the last access token it acquired and calls get_token() only when this cached token will soon expire. This isn't safe with on-behalf-of tokens because they contain a user assertion identifying the user on whose behalf the application accesses resources. When an application changes its intended user, a client must not continue using a token for the prior user. Our design for on-behalf-of authentication makes the credential responsible for tracking the application's user assertion changes, which is to say it requires BearerTokenCredentialPolicy to call get_token() every time it authorizes a request. So, this PR adds TokenCredential.supports_caching(). BearerTokenCredentialPolicy calls this method to learn whether a given TokenCredential maintains its own token cache. When this returns True, BearerTokenCredentialPolicy defers to the credential's cache, calling get_token() every time it wants to authorize a request. The policy doesn't expect all credentials to implement this method, and assumes it's safe to cache tokens from credentials which do not.

[chlowell]

Closing in favor of #20451