[Enhancement] authentication refresh support for mTLS auth

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Motivation

The behaviour that the `authenticationRefreshCheckSeconds` config enables should be available for all auth types whose credentials can expire. This is the case for JWTs (and i think also OAuth). So one motivation is simply providing consistency / no surprises. And of course this feature would be very useful for mTLS. Furthermore, without it, kind of makes using mTLS unattractive - and we can have obviously have scenarios where an cert that was used to auth, becomes expired - but the auth'd connection can remain. for infinity!

### Solution

There is an existing pattern for this, as implemented for [tokens](https://github.com/apache/pulsar/blob/bbc62245c5ddba1de4b1e7cee4ab49334bc36277/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderTls.java) (and OAuth). Solution is to reverse engineer / grok that pattern - and apply it.

Also, this [PIP](https://github.com/apache/pulsar/wiki/PIP-55%3A-Refresh-Authentication-Credentials) and the the [AuthenticationState](https://github.com/apache/pulsar/blob/ccc2ea67c192b4771c9af30c6eaf994fe01958e5/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationState.java) provide good info on the interface methods that need implementing.

### Alternatives

_No response_

### Anything else?

I tagged this as an enhancement, but could be a bug depending on your perspective. At a min the associated docs are [incomplete](https://github.com/apache/pulsar/issues/22124).

### Are you willing to submit a PR?

- [X] I'm willing to submit a PR!