avoid using custos refresh tokens which are expired

[martenson]

if merged, I would like to backport this to release_24.2

• this will prevent galaxy spamming the auth provider endpoint with doomed refresh attempts for each of these users' request
• afaik the consensus is that we do not log out user in this case atm, details in OIDC tokens #15300
• this PR also avoids calling the endpoint if we have no refresh_token, which is a common situation (see Enable offline_access scope for Elixir OIDC provider usegalaxy-eu/infrastructure-playbook#1341 and clarify that extra_scopes is sometimes non-optional #19385)

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. set up OIDC
  2. craft an expired token (or receive & wait)
  3. observe no request is issued and no exception thrown

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.