Better key rotation support

[skjolber]

Add some form of reactive support which track whether downstream services accept the cached JWT token.

When a downstream service does not accept the token (i.e. HTTP 401 or equivalent):

• determine whether the current token was the rejected token
  • yes: force refresh token
  • no: force refresh throttled

Add some basic retry wrappers for instant refresh of tokens + optional service unavailable on 401. Setting negative health will not work well, rather have to return 503 to individual requests.