Don't warn of newer tasks if in grace period

[zregvart]

Adds new rule data task_expiry_warning_days (default 0) if given and greater than 0 then any Task that will expire in task_expiry_warning_days days will emit a warning.

Also adds effective_on of the newest Task to the message of the policy rules asserting that the Tasks used are up to date.

Reference: https://issues.redhat.com/browse/EC-944

[zregvart]

I'm wondering if we want the grace period, there is a scenario when a newer task is available and within a grace period long enough or often enough that the Task that is used is no longer trusted. So by that point no warning would be seen until a blocking violation. Perhaps I misunderstood what EC-944 want's to achieve.

[lcarva]

I'm wondering if we want the grace period, there is a scenario when a newer task is available and within a grace period long enough or often enough that the Task that is used is no longer trusted. So by that point no warning would be seen until a blocking violation. Perhaps I misunderstood what EC-944 want's to achieve.

Yeah, it's a risk. I think we just have to make sure there is enough time between the grace period and the time it becomes a violation. We could make sure that that period is still 30 days. WDYT?

Also... Konflux is decreasing the frequency of updates to once a week so I think that increases the need of this PR as well as maybe requiring us to reassess if users still have at least 30 days to update from a visible warning.

[zregvart]

I'm thinking 8d4943c should stay and 58da16f should go

[lcarva]

I'm thinking 8d4943c should stay and 58da16f should go

If we have concerns with EC-944 we should probably discuss in the Konflux Architecture call. The goal of that story was to intentionally hide some warnings on the basis that they are noisy and hide more important warnings.

[zregvart]

I'm reworking this based on the expires_on from the trusted task record

[zregvart]

Updated description to reflect the latest implementation