Mounted secrets are automatically updated into pods, but...
* It doesn't work with `subPath` mountings
* When `subPath` is not used, then a bunch of directories are mounted
* And one of those directories is a symlink, so `IsDir()` returns false
* And a watch is needed to notice the change

So, update the certificate volume patch, which requires a change in how
we look for certificates in the CA cert directory.

Add a watch, so when the certs do change, we update the cert pool.

Also look at validity dates of certificates, and error on expired certs.

The default cert-manager certificates have 90 days validities.

Signed-off-by: Todd Short <tshort@redhat.com>

Signed-off-by: Todd Short <tshort@redhat.com>

Signed-off-by: Todd Short <tshort@redhat.com>