Is your feature request related to a problem? Please describe.

not_after can be overridden by the signing API, up to the duration of the intermediate CA's lifetime.

Describe the solution you'd like

For operators who want to strictly bind issuance to ttl and not allow callers to set not_after, we should allow a not_after=forbid value. This would prevent cert_util.go from reading not_after from the request parameter, potentially erring out if provided.

Describe alternatives you've considered

An alternative design that could be useful would be a not_after_bound API that takes one of three values:

1. forbid,
2. ttl-limited (to allow precise control of not_after within the bounds of ttl,
3. An explicit maximum timestamp, useful for when not_after_behavior=permit (e.g. on root->leaf simple CAs).

This would be more flexible, but the question remains whether either of the two additional limits would be worthwhile. The answer is probably yes, so perhaps switching not_after to be strictly a time.Time typed field could be worthwhile.

Explain any additional use-cases

n/a

Additional context

I noticed this while looking through review of #487 to ensure we had rough parity. PKI allows control of not_after by the user as well as the role, but in SSH we only allow the role to control this value.

Strictly, changing not_after=forbid would be the safest option for PKI, but this would likely break existing integrations.