Vault Agent: schedule PKI certificate rotation during maintenance windows

## Feature request

Vault Agent automatically renews certificates rendered by templates using `pkiCert`. However, operators cannot control when the renewed certificate is rendered and its associated `exec` command is run.

This can be disruptive when certificate updates trigger actions such as reloading Vault, HAProxy, etcd, databases, or other infrastructure services. In production, we would prefer to perform these actions during a maintenance window.

Would it be possible to add an optional rotation schedule to Vault Agent templates?

For example:

```hcl
template {
source = "/etc/vault-agent.d/pki_vault.ctmpl"
destination = "/etc/vault/tls/pki_vault.rendered"

rotation_schedule = "0 3 * * *"
rotation_window = "2h"

exec {
command = ["systemctl", "reload", "vault"]
}
}
```

The existing PKI renewal logic would still determine when a certificate becomes eligible for renewal. If a schedule is configured, Vault Agent would wait for the next rotation window before issuing and rendering the new certificate.

The schedule should never put certificate validity at risk. If the certificate would expire before the next rotation window, Vault Agent should renew it immediately.

Configurations without a rotation schedule should retain the current behavior.

This would keep certificate renewal automated while allowing potentially disruptive reloads or restarts to happen at predictable times.

---

There is an example how this implemented in k8s cert-manager - https://cert-manager.io/docs/usage/certificate/#renewal-policies-and-renewal-windows

Start by tracing Vault Agent's existing pkiCert renewal logic and how template rotation and the associated exec command are handled. Compare the requested schedule and validity safeguards with the linked cert-manager renewal-window example; done means scheduled configurations defer eligible rotations safely, unscheduled configurations retain current behavior, and expiry cannot be risked.

Written by the indexing model from the issue text.