Refresh credentials atomically

[keithduncan]

I have implemented a draft fix for #443. This changes the Paws::Credential API contract to have a refresh method to retrieve the providers' credentials rather than exposing access_key, secret_key, and session_token directly.

Pushing all accesses though a method which returns a single product type means field retrieval cannot be sheared by a refresh between reads.

I have reused the Paws::Credential::Explicit type as the return value from refresh as it is already a product type of these three fields. I did and still do consider creating a new type which includes an expiration field so that the fields carry their expiration with them rather than it being a property of the provider.

There is more work that can be done on the providers' error handling. When we have a cached credential and are pre-emptively refreshing we can return the cached credential instead of failing to refresh.

I think we could also refactor some of the common refresh code, cache and expiration handling out of the providers and into the Paws::Credential role.