Refreshed OIDC tokens should be persisted to configuration file

Nobody has claimed this yet.

OIDC auth support was added in https://github.com/abonas/kubeclient/pull/396. It includes support for expired ID tokens (expanded in https://github.com/abonas/kubeclient/pull/407 to handle certificate rotation on the authentication server) and refreshes them when fetching a context from configuration.

The [README states](https://github.com/abonas/kubeclient/pull/396/files#diff-04c6e90faac2675aa89e2176d2eec7d8R334):

> Note: id-tokens retrieved via this provider are not written back to the $KUBECONFIG file as they would be when using kubectl.

This in itself would be ok if it were the whole story, since it would imply simply repeated token refreshes on each use.

What's not taken into account here is that refresh tokens are single-use. If kubeclient refreshes an ID token, it "spends" the corresponding refresh token such that it can never be used again, but it doesn't record the new refresh token anywhere. This means that any other tool which uses the configuration file, or indeed a follow-up use of the config file by kubeclient (even in the same process, even using the very same instance of `Kubeclient::Config`), will encounter both an expired ID token and an invalid refresh token, and will raise an exception like this one:

```
...
4: from /var/lib/gems/2.5.0/gems/kubeclient-4.3.0/lib/kubeclient/config.rb:162:in `fetch_user_auth_options'
3: from /var/lib/gems/2.5.0/gems/kubeclient-4.3.0/lib/kubeclient/oidc_auth_provider.rb:37:in `token'
2: from /var/lib/gems/2.5.0/gems/rack-oauth2-1.9.3/lib/rack/oauth2/client.rb:122:in `access_token!'
1: from /var/lib/gems/2.5.0/gems/rack-oauth2-1.9.3/lib/rack/oauth2/client.rb:148:in `handle_response'
/var/lib/gems/2.5.0/gems/rack-oauth2-1.9.3/lib/rack/oauth2/client.rb:171:in `handle_error_response': invalid_request :: Refresh token is invalid or has already been claimed by another client. (Rack::OAuth2::Client::Error)
```

In order to behave correctly, similarly to kubectl, kubeclient must update the configuration file it consumes with the new tokens when a refresh happens.

Is there any reason not to implement this? Does anyone have any thoughts on how it might be implemented? I made something of a start at https://github.com/abonas/kubeclient/pull/408, but I'm not really happy with the direction it's going right now. I wonder if it should be the responsibility of `Kubeclient::OIDCAuthProvider` to update the `Kubeclient::Config` instance's values?

Start by reading lib/kubeclient/config.rb and lib/kubeclient/oidc_auth_provider.rb, then review pull request 408 and the README note about OIDC tokens. Determine where refreshed ID and refresh tokens belong in the consumed configuration and how the configuration file should be updated. Done means subsequent uses and other tools can use the newly persisted tokens without an invalid refresh-token error.

Written by the indexing model from the issue text.