WIP: Added refresh to the metadata credentials.

This also heavily restructures the module itself, which enables adding/removing credentials without altering module-level scope. The behavior should be backward-compatible, though if anyone was importing the functions (or altering the global list of credentials), that will break.

At this time, there's one failing test & I'm planning on adding tests for the ``CredentialResolver``, but I'd like to get some early-ish feedback on the approach. Feedback is most welcome. I'd like to think this is a good change, but would be happy to fix/change any part of it.

Review please? @jamesls @danielgtaylor @garnaat