PKI renew strategy will cause renew time really close to expiration time

### Consul Template version

```bash
consul-template -v
consul-template v0.32.0 (a9261315)
```

### Expected behavior

PKI certificate should be reload at least 87% of lifespan in [vault_pki#goodfor](https://github.com/hashicorp/consul-template/blob/main/dependency/vault_pki.go#L115) function.

### Actual behavior

If jitter output minus result, it may let the watcher sleep again after first awake. For example:

First we issue a 24hr certificate and start calculate `goodfor` value, the [four variables inside function](https://github.com/hashicorp/consul-template/blob/main/dependency/vault_pki.go#L127-L130) will be:

```go
lifespan := "24h"
duration := "24h" // since we calculate after issuing it
gooddur := "24h * 0.9" = "21.6h"
mindur := "2.4h"
```

if we assume jitter output 87% of duration:

```go
gooddur = "24h * 0.87" = "20.88h"
```

Now the watcher will start sleep for 20.88 hours and after it wake up and start calculate the `goodfor` again:

```go
lifespan := "24h"
duration := "24h - 20.88h" = "3.12h"
gooddur := "3.12h * 0.9" = "2.808h"
mindur := "2.4h"
```

this time `gooddur` is still greater than `mindur` which causing sleep again!

The third time calculation will cause reloaded time really close to expiration time.

### Solution

Calculate `midur` to `0.87 * lifespace`.

Start in dependency/vault_pki.go at the goodfor function and trace how the watcher uses its returned duration. Reproduce the 24-hour certificate calculation described in the issue, then verify that renewal is scheduled before the certificate approaches expiration and that the watcher does not repeatedly defer renewal.

Written by the indexing model from the issue text.