It looks like almost all of the usage is in tests. For now, let's add an API to IdentityTestEnvironment/identity_test_utils to update the persistent error state for the refresh token for a given account. There might be one or two production usages of this method outside of code that will be inside the IdentityManager implementation; we can look at those when they come in focus later on.