AS-290: ImpersonatingAuthenticator caches token

This is an optimization over current code where each `authenticate_tenant` first authenticates us against identity and then looks for impersonation token. This code will cache the token returned from identity and reuse it until it gets 401 in which case it will reauth and use the new one. This probably does not impact current usage of auth as much as it will impact auth's usage in metrics since it is going to be impersonating many tenants in a short time.
This seems like it might be a useful function for some of the other worker functions too if we get a 401, but if the auth token doesn't get passed, it seems like it'd only apply to the `ImpersonatingAuthenticator`?

If so, would it make sense for this to be a function in the auth module instead?  Or would it be possible to make the function take an auth token, and the auth function return an auth token?