We should add RA proxying to EjbcaWS.getCertificatesByExpirationTime. 

Make sure that none of the above calls makes any additional local EJB calls, and try to keep the entire call chain to a single call to RAMasterAPI. 

The results should be checked upstream first. The API version for this call will be 4.

The changes made in this ticket must not in any way change the behavior of the WS API