Use same lifetime for serving cert and CA cert

So that operators won't look at the lifetime of the CA cert and be
like, "wtf, why does the serving cert have the lifetime that I
specified, but its CA cert is valid for 100 years".

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

pkg/config/api/types.go

@@ -45,7 +45,8 @@ type APIConfigSpec struct {
 type ServingCertificateConfigSpec struct {
 	// DurationSeconds is the validity period, in seconds, of the API serving
 	// certificate. By default, the serving certificate is issued for 31536000
-	// seconds (1 year).
+	// seconds (1 year). This value is also used for the serving certificate's
+	// CA certificate.
 	DurationSeconds *int64 `json:"durationSeconds,omitempty"`
 
 	// RenewBeforeSeconds is the period of time, in seconds, that pinniped will