cli: adds plugin identity token to enable and tune commands for secret engines and auth methods (#24980)

* adds plugin identity token to secrets CLI for enable and tune

* adds plugin identity token to auth CLI for enable and tune

* adds field to mount config input and output

* adds changelog

* fix tests

* fix another test

command/auth_tune.go

@@ -39,6 +39,7 @@ type AuthTuneCommand struct {
 	flagUserLockoutDuration             time.Duration
 	flagUserLockoutCounterResetDuration time.Duration
 	flagUserLockoutDisable              bool
+	flagIdentityTokenKey                string
 }
 
 func (c *AuthTuneCommand) Synopsis() string {
@@ -195,6 +196,13 @@ func (c *AuthTuneCommand) Flags() *FlagSets {
 			"the plugin catalog, and will not start running until the plugin is reloaded.",
 	})
 
+	f.StringVar(&StringVar{
+		Name:    flagNameIdentityTokenKey,
+		Target:  &c.flagIdentityTokenKey,
+		Default: "default",
+		Usage:   "Select the key used to sign plugin identity tokens.",
+	})
+
 	return set
 }
 
@@ -294,6 +302,10 @@ func (c *AuthTuneCommand) Run(args []string) int {
 		if fl.Name == flagNamePluginVersion {
 			mountConfigInput.PluginVersion = c.flagPluginVersion
 		}
+
+		if fl.Name == flagNameIdentityTokenKey {
+			mountConfigInput.IdentityTokenKey = c.flagIdentityTokenKey
+		}
 	})
 
 	// Append /auth (since that's where auths live) and a trailing slash to