b3c9783427
When an OpenAPI OAuth2 credential has an expired access token and a refresh token, refresh it (reusing the shared OAuth2 helpers) before wrapping it as a bearer token, instead of returning the stale token. Refresh failures fall back to the existing token. Co-authored-by: George Weale <gweale@google.com> PiperOrigin-RevId: 956058160