Certificate renewal before expiration

[matzf]

All the TRCs and Certificates have an expiration timestamp. Currently, this is just set "far enough" in the future to avoid having to deal with this. With all the functionality to update and re-issue certificates we already have in place, it is should be easy to set a mechanism that updates certificates before they expire.
We should be able to use recurring tasks from huey for this (adding huey is already on the way).