Cache access tokens

When the API client is requested multiple times in close succession, we should be caching the last app installation access token for perhaps half of its declared expiration time, to minimize contacts to the API server.

Start at the Java API client entry point and follow how app installation access tokens are requested and their declared expiration is exposed. Confirm the reuse window and add coverage for repeated requests; done means valid tokens are reused for the intended period while expired or unavailable tokens are fetched again.

Written by the indexing model from the issue text.