Grace period after expiry during which a 'block' policy still allows
the credential through (loudly). Defaults to 0 — no grace.
Set this when a hard cutoff at the expiry instant is riskier than a
short, noisy overrun (for example, an overnight batch job that would
otherwise fail at midnight with nobody watching). Grace does not change
the reported CredentialExpirationStatus — an expired credential
inside grace still reports 'expired', so dashboards and audit logs
tell the truth.
What to do with an expired credential. Defaults to 'block'.
How far ahead of expiry a credential is reported as 'expiring-soon'.
Defaults to DEFAULT_EXPIRATION_WARNING_WINDOW_MS (30 days).
This only affects reporting and warning logs — it never blocks.
Configuration governing how credential expiry is enforced.