AS-290: ImpersonatingAuthenticator caches token

This is an optimization over current code where each `authenticate_tenant` first authenticates us against identity and then looks for impersonation token. This code will cache the token returned from identity and reuse it until it gets 401 in which case it will reauth and use the new one. This probably does not impact current usage of auth as much as it will impact auth's usage in metrics since it is going to be impersonating many tenants in a short time.
Would it make sense to make this a different error rather than `ValueError` here and in the previous test?  Since `_auth` also returns a `ValueError`, it wouldn't be clear whether the retry was propagating the original failure or `_auth`'s `ValueError`.

Wonder if it would also be useful (non-blocking) to include a test that shows that errors from `_auth` are also propagated?