[tools] Add d8 tools pki certs check for control-plane certificate expiration inspection

[AmazinMax]

Description

Add d8 tools pki certs check to deckhouse-cli to inspect local control-plane certificate expiration using the go_lib/controlplane expiration API from the companion PR deckhouse/deckhouse#19959.

• registers a new tools -> pki -> certs -> check command tree in d8
• supports full-scan mode for known control-plane PKI artifacts and kubeconfig client certificates
• supports single-file inspection for both PEM certificates and kubeconfig files
• renders kubeadm-like output with separate sections for leaf certificates and certificate authorities
• adds --kubeconfig-dir for non-standard layouts; by default it resolves to the parent directory of --path
• does not restart, reconfigure, or otherwise affect critical cluster components; it only adds a local inspection command to d8

Screenshots

Full scan

Single-file certificate

Single-file kubeconfig (client certificate)