server,rpc,security: enable TLS authorization for tenant servers using names instead of IDs

Currently the TLS authentication code (in the rpc and security packages) uses a special URN that identifies a tenant peer server using its numeric tenant ID.

Authentication is performed by simply verifying that the cert is signed by the CA. There is no further validation of the tenant ID.

We would like to transition to a world where it's possible for a tenant server to authenticate itself using a TLS cert that identifies the tenant *by name* instead of by ID.

For this we need to do two things:

1. define a new URN format in the cert for a name-based identity
2. during authentication, verify that the name in the cert matches the tenant ID by performing a lookup (KV-side).

Jira issue: CRDB-28992

Epic CRDB-39093