Trust check

[deads2k]

fixed version of #1461

When done after rotating signers, but before rotating targets, it produces

[deads@fedora ~]$ oc adm ocp-certificates remove-old-trust -n openshift-config-managed configmaps --all --dry-run --created-before=2023-06-15T14:04:28-04:00
error: failed to apply changes to openshift-config-managed/kube-apiserver-aggregator-client-ca: secrets only trusted by the old bundle: [secrets/aggregator-client[openshift-kube-apiserver]]
[deads@fedora ~]$ oc adm ocp-certificates remove-old-trust -n openshift-kube-apiserver-operator configmaps --all --dry-run --created-before=2023-06-15T14:04:28-04:00
failed to apply changes to openshift-kube-apiserver-operator/kube-apiserver-to-kubelet-client-ca: secrets only trusted by the old bundle: [secrets/kubelet-client[openshift-kube-apiserver]]
failed to apply changes to openshift-kube-apiserver-operator/kube-control-plane-signer-ca: secrets only trusted by the old bundle: [secrets/kube-scheduler-client-cert-key[openshift-kube-scheduler] secrets/kube-controller-manager-client-cert-key[openshift-config-managed] secrets/kube-scheduler-client-cert-key[openshift-config-managed] secrets/check-endpoints-client-cert-key[openshift-kube-apiserver] secrets/control-plane-node-admin-client-cert-key[openshift-kube-apiserver] secrets/kube-controller-manager-client-cert-key[openshift-kube-controller-manager]]
failed to apply changes to openshift-kube-apiserver-operator/loadbalancer-serving-ca: secrets only trusted by the old bundle: [secrets/external-loadbalancer-serving-certkey[openshift-kube-apiserver] secrets/internal-loadbalancer-serving-certkey[openshift-kube-apiserver]]
failed to apply changes to openshift-kube-apiserver-operator/localhost-recovery-serving-ca: secrets only trusted by the old bundle: [secrets/localhost-recovery-serving-certkey[openshift-kube-apiserver]]
failed to apply changes to openshift-kube-apiserver-operator/localhost-serving-ca: secrets only trusted by the old bundle: [secrets/localhost-serving-cert-certkey[openshift-kube-apiserver]]
failed to apply changes to openshift-kube-apiserver-operator/node-system-admin-ca: secrets only trusted by the old bundle: [secrets/node-system-admin-client[openshift-kube-apiserver-operator]]
failed to apply changes to openshift-kube-apiserver-operator/service-network-serving-ca: secrets only trusted by the old bundle: [secrets/service-network-serving-certkey[openshift-kube-apiserver]]

[stlaz]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [deads2k]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cgwalters]

Minor nit, this could use the ManagedCertificateTypeLabelName constant