Unify the certificate-expiration buffer to an integer day count

Problem

*_cert_expiration_buffer carries the same name in four roles but two incompatible value
formats:

The split has a real cause: the three roles inspect passphrase-protected .p12 files, which
x509_certificate_info cannot read (path: "PEM and DER formats are supported", and there is no
passphrase option) - hence the own cert_info module, which returns only a date and no
validity boolean.

The consequence is a silent failure. A user who sets one format everywhere breaks the other
side: "+30d" | int evaluates to 0, so days <= 0 is never true and the certificate is
never renewed - without any error.

Want

One value format in all four roles: an integer day count. Change the beats role to compute the
remaining days from the module's not_after return and compare it as an int, like the other
three roles already do. No module change needed, and the concrete "expires in N days" message
becomes available in beats too.

Breaking: beats_cert_expiration_buffer: "+30d" becomes beats_cert_expiration_buffer: 30.

Start by locating the beats role's certificate-expiration task and compare its x509_certificate_info usage with the cert_info handling used by Elasticsearch, Kibana, and Logstash. Change the beats buffer to an integer day count derived from not_after, then verify all four roles use the same format and that beats exposes the remaining-days message.