Central authority for invoking GetCredentialMaterialAsync. Builds a CredentialContext from the active request, invokes GetCredentialMaterialAsync exactly once, and validates the returned CredentialMaterial before handing it back to the TokenClient.