fix: renew authn's own client certificate and clamp the login JWT to it

[EdmondDantes21]

authn-clientconfig was written once, at startup, and never renewed. A pod outliving its certificate kept presenting an expired one and every RESTAction call to snowplow failed with x509: certificate has expired until someone restarted it. The signer grants min(requested, --cluster-signing-duration, signer CA remaining life) — OpenShift pins the middle term to 720h and rotates its signer CA every 30 days, so the year we ask for can come back as a day.

• Read the granted window off each issued certificate instead of assuming the request held; record it on the Secret as authn.krateo.io/certificate-not-{before,after} and warn when it is under 90% of what was requested.
• Renew authn-clientconfig in the background (internal/certrenewal): issue at startup, re-issue once the certificate passes AUTHN_CRT_RENEWAL_THRESHOLD of its granted lifetime. The certificate is read once per issuance and the loop sleeps straight to the due point — a year-long certificate is one ~8-month sleep, not a poll.
• Clamp the login JWT to the certificate's real NotAfter in encode.Success, so a session can no longer outlive the credential it authenticates with. This is what makes per-user <user>-clientconfig Secrets not need a renewal loop; the reasoning is in the README.
• New knobs (all default to today's behaviour): AUTHN_SERVICE_CRT_EXPIRES_IN (the 8760h that was hardcoded in main.go), AUTHN_CRT_RENEWAL_THRESHOLD, AUTHN_CRT_RENEWAL_ENABLED.
• No new RBAC. The annotations are written with the get+update on secrets authn already holds, so no chart change is required to ship this.

scripts/verify-cert-renewal.sh automates the three checks that have to be measured per distribution (granted window, renewal fires before expiry, apiserver still accepts the renewed certificate).

Verification

Unit tests cover the renewal policy, certificate parsing and the clamp. Verified end to end on kind: 7 consecutive renewals at a 10m TTL, each firing ~9 minutes before its own expiry, each renewed certificate accepted by the apiserver as authn/[authn system:authenticated], exactly one CSR object throughout, and a real login returning a 23h54m57s token against a 24h request.

kind honours spec.expirationSeconds in full, so a capped signer is still unexercised — OpenShift, minikube, k3s, EKS, AKS and GKE remain unverified.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️