Add client_cert_expiration_seconds metric

[lavacat]

What would you like to be added?

Approximate list of metrics:

client_cert_expiration_seconds

Why is this needed?

client_cert_expiration_seconds track when client certs expire, useful for alerting. Similar to apiserver clientCertificateExpirationHistogram

[lavacat]

draft PR #21621

[serathius]

Can you take a look how Kubernetes does this? Best would be to match similar design.

[lavacat]

updated issue to add only client_cert_expiration_seconds

we don't have authenticator package with Request interface in etcd like apiserver has.
grpc.StatsHandler looks like a good place to inspect the cert - it will happen after tls handshake