exception in refresh does not trigger degraded health

[iay]

We had a problem where (many) refresh operations were hitting Java out of heap errors (via the "uncaught exception" handler. I would have expected this to cause the health endpoint to report a DEGRADED status, but that doesn't seem to have been the case. We did see some timeouts.

A failure in the refresh operation should always result in degraded health, at least until the next successful refresh.

The reason for this isn't obvious, but it's probably related to the fact that as currently coded the degraded status is only signalled if the last successful refresh is more than two refresh intervals ago. So if, for example, every second refresh succeeds, you'll never notice.