Make the ID checks more restrict in the webapi test URL functions.

This enhances the logic of the various get_*_url() functions to be more
strict when they're willing to accept either an ID or an object.

A new function, _normalize_id(), checks if the value is an ID or an
instance (or subclass) of the allowed class type. If it's not any of
these things, then a ValueError will be raised.

This reduces the complexity of the code in the functions, prevents
duplication, and adds enhanced error checking.

Reviewed at https://reviews.reviewboard.org/r/5898/