avoid using custos refresh tokens which are expired

[martenson]

if merged, I would like to backport this to release_24.2

• this will prevent galaxy spamming the auth provider endpoint with doomed refresh attempts for each of these users' request
• afaik the consensus is that we do not log out user in this case atm, details in OIDC tokens #15300
• this PR also avoids calling the endpoint if we have no refresh_token, which is a common situation (see Enable offline_access scope for Elixir OIDC provider usegalaxy-eu/infrastructure-playbook#1341 and clarify that extra_scopes is sometimes non-optional #19385)

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. set up OIDC
  2. craft an expired token (or receive & wait)
  3. observe no request is issued and no exception thrown

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[kysrpex]

For reviewers: I guess if this PR is merged it would also make sense to go to psa_authnz.py and change it to check that "refresh_token" in user_authnz_token.extra_data before attempting to refresh tokens (given that the issue is unlikely to be fixed in social-core itself). I would open a PR myself then.

[martenson]

@kysrpex feel free to piggyback onto this PR (open PR against my fork martenson:ignore-expired and I'll bring it here)