Walks the supplied CredentialResolver chain (after optionally applying configureOverrides to a writable overlay of credentialSection) and returns a cached CredentialSettings bound to the section the chain saw, with TokenProvider populated when a resolver matches. When no resolver matches, returns the cached inline-only settings for that section. Returns null only when the section does not exist. The returned instance is shared across callers — treat it as read-only.