feat(cache): source-aware refresh/eviction TTLs + pod-level logging

[gargipanatula]

*Note - this was previously reviewed by bhavi-koduru@ in (gargipanatula#9) against my local fork - this PR is a duplicate so that we can apply the changes against an upstream branch.

Makes the credential cache source-aware. Until now the cache applied one refresh/eviction policy to every credential; this teaches it that IMDS-sourced credentials and EKS Auth-sourced credentials age differently, and tags each cache entry with the source that produced it. When a credential is stored or refreshed, the cache now:

• Extends refresh and eviction calculation to IMDS
  • EKS Auth: unchanged — refresh at min(remaining, renewal TTL), evict when the credential expires
  • IMDS: refresh every ~30 minutes and never evict on expiry — IMDS creds are statically stable during an LSE, so an expired one is still worth serving
• Extends its "is this credential still usable?" decision making to IMDS - IMDS creds are always treated as valid while Auth creds must still have real remaining TTL
• Extends the irrecoverable classification to IMDS - loops in the IMDS irrecoverable classifier alongside the existing eksauth one

Also enhances logging w/ podUID so cache behavior is traceable per pod.

This is an intermediate layer — the chain still isn't wired into the handler, so there's no runtime behavior change. The IMDS delegate that actually produces SourceIMDS entries gets wired in behind a flag in the follow-up PR. Right now, all credentials will still be from eksauth.

Note - the shared pod-UID parser moved to credentials.GetPodUIDFromToken; this PR drops the private getPodUIDfromServiceAccountToken copy and calls the shared one.

Testing: make build and make test green
Some new tests to highlight:

• Source defaulting
  • A cache entry with no metadata reports auth-service, so a failure to apply this new metadata logic fallsback to default behavior
• Per-source TTL selection
  • IMDS → refresh ~30m, eviction never; Auth → refresh min(remaining, renewal), eviction at expiry
• "Is it still valid?" by source
  • IMDS entry is honored even when its expiry is in the past; Auth entry is only valid while remaining TTL clears the minimum
• Source-aware background refresh
  • A recoverable failure re-inserts the entry with source-specific TTLs
  • A successful refresh of an expired IMDS entry replaces it with fresh creds
  • An irrecoverable error evicts the entry regardless of source