gsutil uses expired token for authentication for 1st time and then retries with refreshed creds post failure

While using gsutil, we noticed bit weird behavior where the 1st call from gsutil is unauthenticated and due to the internal retry it tries with refreshed credential and request goes fine.

Expected behavior: there should be automatic refresh of credential based on time elapsed.

Motivation: We have a alert policy in GCP monitoring which gets triggered very 2-3 hours because there is a unauthenticated request generated from gsutil from the client side. We would like to keep this policy since it notifies us incase someone is trying to reach our bucket.

Start with gsutil's authentication flow and the internal retry path described in the report. Reproduce the first-call failure with an expired token, then trace when refreshed credentials are loaded. Done means the initial request no longer produces an unauthenticated attempt while preserving successful authentication and the reported monitoring behavior.

Written by the indexing model from the issue text.