Periodically refresh keyring.

This change allows kubelet to use the latest credential when it fetches
docker images.
I'm not sure it is safe to have a non-pointer receiver to an object with a lock in it.  Will you be locking a copy of the lock?
  

Please run go vet on this code and fix any lock reference warnings.