Previously the expiration times were right on the cusp of being included or not
included in the query. Adjusted the times to be solidly in the right range.
In a future PR, we should refactor the code to generate absolute expiration
times and have findExpiringCertificates take a time param, so the test isn't
dependent on time.Now().