substantial cleanup of the renew method and client

substantial cleanup of the renew method and client
* sfi -l aka --as-long-as-possible is supported in sfi
* sfi renew <> +2d / +3w / +4m is now working as well as the other time formats (int, rfc3339...)
* most importantly the final expiration time is trimmed to the min of credential expiration and max_slice_renewal, but goes on with these values instead of whining