fix(balancer): separate keepalive pool by referenced client cert

[shreemaan-abhishek]

Description

When an HTTPS/GRPCS upstream sets its client certificate via tls.client_cert_id (referencing an SSL object) rather than an inline tls.client_cert, the keepalive connection pool name did not include any cert identifier.

The pool name only appended tls.client_cert (the inline PEM). For upstreams referencing certs by id, that field is empty, so two upstreams pointing at the same backend host/port/SNI but using different client_cert_ids collapsed into the same pool and could reuse each other's already-established TLS connections.

This change appends tls.client_cert_id to the pool name when an inline cert is not present, so connections established with different referenced client certs are kept in separate pools.

A regression test in t/node/upstream-keepalive-pool.t sets up two upstreams to the same backend with different client_cert_ids and asserts their connections are not shared (it fails before this change and passes after).

Which issue(s) this PR fixes:

Fixes #

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)