Warn about certicates that are about to expire

If a certificate is about to expire then we should warn the user and suggest that they run sq key expire to extend the expiration, or sq key rotate to generate a new certificate.

A simple way to define "about to expire" is X months before the expiration. To make things concrete, let's make X 3. Now consider a certificate that expires 1 month after its creation (or last extension of its expiration). In this case, the warning will always be issued, which is annoying. Instead, I propose we warn if the time to expiry is less than min(3 months, 0.1 * (expiration time - binding signature's creation time)).

We need to consider when to do the check. We don't want to check every a lot of certificates every time that sq is run. That would be expensive. Instead, I think it is probably enough to do the check when a certificate is used. For instance, we do the check when sq sign looks up the signing certificate.