Add warning state to rotation

[hallipr]

This change allows for a secret to be in a warning state (should have been rotated previously and is close to expiration) and replaces the state booleans Expired, ThresholdExpired, and now WarningExpired with a single state enum:

    Error,
    UpToDate,
    Rotate,
    Warning,
    Expired,

If any secret enters the WarningThreshold, the cli will categorize it as Expiring and the status command will return a non-zero exit code.

The WarningThreshold for plans should be configured so there is reasonable time past the RotationThreshold to allow for rotation and prevent unnecessary warnings.

[weshaggard]

should we have a smart default? Perhaps half the time of the expire?

[hallipr]

I think that will be rotationThreshold / 2.

For the config:

{
  "rotationPeriod": ".180.00:00:00",
  "rotationThreshold": "30.00:00:00"
}

we'd get the implicit:

 "warningThreshold": "15.00:00:00"

meaning, we create a 180 day secret and rotate it 30 days before expiration. If we haven't rotated it 15 days before expiration, we start reporting a warning