[hjjackyang]

Why? The existing way of storing the OAuth tokens in user's local file system is insecure.

The new change implements the following:

1. Stores OAuth tokens in user's system keyring.
2. If system keyring is locked, the keyring library will prompt users to unlock. Times out in 30s if users don't confirm unlocking. Kicks off a new OAuth flow.
3. If a legacy token file exists on user's local filesystem, CLI will attempt to migrate that into keyring and clean it up.

---

Tested locally with:

# Complete the OAuth flow to list sessions
uv run colab --auth=oauth2 sessions

# Examine the token json stored in keyring
uv run keyring get google-colab-cli oauth_token

---

Internal tracking bug: b/575978563