Make client-credentials token refresh buffer and jitter configurable

Checklist

• I agree to the terms within the OpenFGA Code of Conduct.

Describe the problem you'd like to have solved

In SDK 0.9.11, the client-credentials token expiry buffer is hardcoded to 300 seconds, plus 0–299 seconds of jitter. With Keycloak issuing 300-second access tokens, a freshly cached token is immediately considered stale. Sequential API calls therefore request new tokens instead of reusing them.

Describe the ideal solution

Allow configuring the refresh buffer and jitter, for example a 30-second buffer with a small jitter for five-minute tokens.

Alternatives and current workarounds

Increasing the Keycloak client's token lifetime avoids the mismatch, but requires longer-lived tokens to accommodate the SDK.

References

https://github.com/openfga/java-sdk/blob/v0.9.11/src/main/java/dev/openfga/sdk/api/auth/AccessToken.java

https://github.com/openfga/java-sdk/blob/v0.9.11/src/main/java/dev/openfga/sdk/constants/FgaConstants.java

Start by reading src/main/java/dev/openfga/sdk/api/auth/AccessToken.java and src/main/java/dev/openfga/sdk/constants/FgaConstants.java, as referenced in the issue, to locate the hardcoded expiry buffer and jitter. Trace how client-credentials tokens are cached and refreshed, then make both values configurable and verify that five-minute tokens can be reused with a smaller buffer and jitter.