metric for workload cert expiry

[garrettheel]

I'd like to be able to monitor workload cert expiry for ztunnel. I believe istio_agent_cert_expiry_seconds and envoy_server_days_until_first_cert_expiring would be similar metrics for sidecars. It could also be useful to see metrics related to failure to renew certs, but expiry would be the most useful.

Related for sidecar: istio/istio#37291

Any suggestions here, or appetite to contribute this as a new metric?

[Stevenjin8]

seems reasonable.

[Stevenjin8]

/assign