Use duration and renewBefore to control API cert rotation

These configuration knobs are much more human-understandable than the
previous percentage-based threshold flag.

We now allow users to set the lifetime of the serving cert via a ConfigMap.
Previously this was hardcoded to 1 year.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

test/integration/api_serving_certs_test.go

@@ -58,7 +58,7 @@ func TestAPIServingCertificateAutoCreationAndRotation(t *testing.T) {
 					return err
 				}
 
-				secret.Data["caCertificate"], err = createExpiredCertificate()
+				secret.Data["tlsCertificateChain"], err = createExpiredCertificate()
 				if err != nil {
 					return err
 				}