create-for-rbac: should use certificate's expiration date as SP's end date

[yugangw-msft]

If a user wants to create a SP with provided cert (not let the command create it for him), we should default SP's end date to the cert's expiration date, otherwise this SP will not be able to create.
Also when the user supply the --years, we should warn them if the years exceeds the cert expiration date and we will use cert's