Certificate expiration events persist after certificates are rotated

[brandond]

Is your feature request related to a problem? Please describe.
When K3s certificates are about to expire, a Kubernetes Event with a Node certificates require attention message is emitted periodically. When the node is restarted to renew certificates, the event does not go away immediately - it just stops being emitted, and will disappear after an hour. This is generally how Events work (they aren't removed, they just expire) but it is somewhat unintuitive.

Describe the solution you'd like
Would be nice if there was a message indicating that certs are all OK / not expired. Absent any specific message indicating that the certs are OK, it is easy to assume that the certs are still expired.

Describe alternatives you've considered
Just wait for the event to go away an hour after they are rotated.

Additional context
In order to track this across restarts, we'd want to add a label or annotation to the Node when certs are expired, and remove this annotation and emit the OK event when no certs are expired.

Label might be nice, because then we could use other tools to label-select nodes with expired certs.