Auth: Extend TLS identity helper functions to support multiple identity types

[kadinsayani]

This pull request extends TLS identity helper functions in preparation for #14884, which introduces cluster link identities, allowing for getting and activating pending TLS identities of different types. Error messages are also improved to return identity type. createCertificateAddToken is extracted from createIdentityTLSPending to allow for reuse.