add support for explicit k3s cert rotation

[poblin-orange]

see https://docs.k3s.io/cli/certificate#client-and-server-certificates

Additional bosh mechanism to trigger k3s rotation (beyond bosh restart ? need dedicated bosh errands ? )