feat: implement vended credential refresh

[gabeiglio]

Third time's a charm (prev PR closed due to staleness) :) Closes #3506

Rationale for this change

Implement automatic vended credential refresh in PyIceberg.

Are these changes tested?

Yes,

1. catalog/test_credential_provider.py test the VendedCredential class
2. test_rest.py tests the attach logic and overall refresh feature
3. io/test_credential_provider.py tests caching and locking

Are there any user-facing changes?

Yes, users will have the option to set the refresh credentials configurations in the catalog

[gabeiglio]

@kevinjqliu I opened this PR as the previous one was closed for being stale. Here I've hopefully addressed your comments!

1. CredentialsProvider now accepts a refresh_fn (passed in by the catalog) to fetch new credentials when needed.
2. FileIO now caches filesystems by credentials too, so a cache hit can no longer return a filesystem built with expired credentials.
3. CredentialsProvider owns the credential resolution logic, and the longest-prefix-match against storage credentials.
4. CredentialsProvider exposes a per-scheme hook so refresh logic can be implemented individually per scheme (currently only implemented for S3).