connect/ca: Make the expiry duration for old CA roots explicitly configurable

At the moment, the leader will periodically prune old CA roots that have been rotated out once they've been inactive for the configured `LeafCertTTL`*2. We should make this explicitly configurable, and possibly add an api for forcing this immediately - the default LeafCertTTL is 72h, so this will typically be days before an old CA is rotated out, which could be far too long if an old root is compromised.