This post has a response from [Carl [Content removed] (Epic Games) that feels like the best description/documentation of the flow in question:
[UBA authentication [Content removed]
Also, to be clear, I’ve used this flow successfully on my local PC.
However, it still puts us right back at the start of this thread, because it only describes the interactive browser login method. So the question still remains: in 5.5 is there a supported method to generate/store a token on a build server that runs CI jobs in a non-interactive (service) mode? If so, what is the secret? 
(and to clarify, a CI job for us is just a command line run of UBT - pretty much the same as we would do on a local PC but with diff params)