Azure Workload Identity returns HTTP 401 errors after a Puma
worker or Sidekiq process runs for about 1 to 2 days. Restarting
the pod clears the error.

The root cause: a previous fix only refreshed the access token on
the SAS URL signing path. Other data-plane requests like
get_blob_properties and get_blob read the @blob_client instance
variable directly, which was built once with a token captured at
startup. After the 24-hour token lifetime expired, these requests
would sign with a stale token, causing Azure to return 401. The
customer hit this via the exists? code path, which calls
get_blob_properties.

This fix adds a private blob_client reader method that calls
maybe_refresh_credentials before returning @blob_client. All 31
request files under lib/fog/azurerm/requests/storage/ now call
blob_client. instead of @blob_client. directly. The refresh is
cheap: it returns early unless the token is near expiry, uses a
try-lock so a slow token endpoint never stalls other callers, and
never rebuilds a token that is still valid.

Fixes #11

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The workload identity path posts to the OAuth v2.0 token endpoint,
which returns a relative expires_in rather than the absolute
expires_on that IMDS returns. The code only read expires_on, so the
token expiry fell back to the current time and refresh_needed? was
always true.

On its own this made the SAS path re-exchange a token on every
call. Combined with refreshing credentials on every blob request, it
would fetch a token and rebuild the blob client on every request.

Read expires_in when expires_on is absent so the expiry is real and
refresh happens only near expiry.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The URL builders call signature_client, which already refreshes
credentials, and then generate_uri only builds a URI string without
authenticating. Reading it through the refreshing blob_client reader
just repeats the refresh check, so use @blob_client directly there.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Refresh credentials on all blob storage requests

Closes #11

See merge request !67

Release v2.5.2

See merge request !68