fix(kms): preserve CA certificates across restart

[kvinwang]

Problem

KMS regenerated its CA certificates on every restart even though the persisted private keys were reused. Clients then saw new CA certificates after each restart, making the advertised trust anchors unstable.

Fix

• Keep the persisted root and temporary CA certificates unchanged during normal startup.
• Renew either CA certificate with the same private key when it has one year or less remaining.
• Continue reissuing the RPC leaf certificate on every startup because it carries the current domain and platform attestation.

New CA certificates retain the existing ten-year default lifetime, so renewal extends their expiry by approximately another ten years without rotating the CA keys.

Scope

• dstack/kms/src/onboard_service.rs
• One focused commit rebased onto master

Verification

• cargo fmt --check --all
• cargo check -p dstack-kms
• cargo test -p dstack-kms ca_certificate_is_renewed_only_within_the_renewal_window
• git diff --check origin/master...HEAD

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.