Consider token lifetime extension semantics of TCR API

[enj]

Today TCR will give you a certificate that is valid until end := time.Now() + 5*time.Minute even if the input token has a expiration time that is before end. This is problematic as one can use the TCR API to effectively extend the lifetime of the token. Ideally we would have a way to issue a certificate that has the exact same expiration as the input token.

[enj]

Well maybe not the exact same lifetime, but instead use min(safe_max_irrevocable_cred, token_exp).