Make KubeClientCertificateExpiration less sensitive

I just got alerted with KubeClientCertificateExpiration alert because
of our Mimir tmp outage (few minutes).

I think this alert would deserve some `for` period which should avoid
any such issues and since the nature of the alert I believe it is acceptable
to receive the alert 5 minutes later in genuine cases.

Author: dohnto

alerts/kube_apiserver.libsonnet

@@ -51,6 +51,7 @@ local utils = import '../lib/utils.libsonnet';
             expr: |||
               apiserver_client_certificate_expiration_seconds_count{%(kubeApiserverSelector)s} > 0 and on(job) histogram_quantile(0.01, sum by (job, le) (rate(apiserver_client_certificate_expiration_seconds_bucket{%(kubeApiserverSelector)s}[5m]))) < %(certExpirationWarningSeconds)s
             ||| % $._config,
+            'for': '5m',
             labels: {
               severity: 'warning',
             },
@@ -64,6 +65,7 @@ local utils = import '../lib/utils.libsonnet';
             expr: |||
               apiserver_client_certificate_expiration_seconds_count{%(kubeApiserverSelector)s} > 0 and on(job) histogram_quantile(0.01, sum by (job, le) (rate(apiserver_client_certificate_expiration_seconds_bucket{%(kubeApiserverSelector)s}[5m]))) < %(certExpirationCriticalSeconds)s
             ||| % $._config,
+            'for': '5m',
             labels: {
               severity: 'critical',
             },