allow CredentialsStore.credentials(AuthScope) to throw

[dmfs]

If a CredentialsStore needs to make network requests itself (like an OAuth2 token refresh) it should be able to distinguish between "no credentials available" and "error while fetching credentials".