force VOMS attribute certificates to have same lifetime as containing certificate