Certificate expiry measured across the chain, not the leaf

Every expiry check looks at the leaf certificate, and a chain contains intermediates and roots with their own dates.

- alert: CertificateChainExpiringSoon
  expr: probe_ssl_earliest_cert_expiry - time() < 86400 * 21
  for: 1h
  labels: { severity: ticket }

- alert: CertificateChainExpiringUrgently
  expr: probe_ssl_earliest_cert_expiry - time() < 86400 * 5
  labels: { severity: page }

earliest_cert_expiry is one word different from the metric everybody uses and covers the whole chain, which is the difference between a comfortable dashboard and a partner outage. Two thresholds matter because a ticket at three weeks and a page at five days are different responses to the same fact.