This feature is similar to ChanProvenance from ChanMgr, except that
we don't yet need to report it outside the crate.  I'm going to use
it to distinguish newly created circuits from existing circuits in
the preemptive circuit builder.

guardmgr: fix a unit test panic.

See merge request tpo/core/arti!454

Apparently on OSX you are not allowed to construct an Instant that is a
long time before the time when the test is running.

Also, fix the length of a year in this test.

Collect and analyze clock skew information

See merge request tpo/core/arti!450

This simplifies the code a lot.

This time, our estimator discards outliers, takes the mean of what's
left, and uses the standard deviation to try to figure out how
seriously to take our report of skew/not-skew.

These estimates are still not actually used.

fix maint/cargo_audit not propagating error and add temporary exceptions

See merge request tpo/core/arti!452

use rustc 1.60 for coverage

See merge request tpo/core/arti!451

using stable doesn't work for CI because a specific version like 1.60 is installed

(This is just a placeholder; I'm going to make the functions
smarter in the next commit.)

(It is not yet actually used.)

(The information is not yet recorded.)

We need this since we want to report certain conditions only when
they happen on a new channel, not if we observe them on a
preexisting channel.

Fortunately, we don't need a separate type here: authenticated
clock skew can only come attached to a `tor_proto::Error`.

We also remove skew from `tor_proto::Error::HandshakeCertsExpired`,
since it would now be redundant.

of a channel.

At first I wanted to have this information not be a part of channels
at all, but it is a fairly tiny amount of data, and the alternatives
are pretty crufty.

Downgrade `rlimit` to 0.7.

See merge request tpo/core/arti!449

Upstream 0.8.2 has broken compilation with Rust 1.53; versions
0.8.{0,1} have been yanked.

Possibly by the time the next arti version comes out, they'll have
fixed this situation, or we'll have upgraded our MSRV.

Upstream issue at https://github.com/Nugine/rlimit/issues/42 .

# Conflicts:
#   doc/semver_status.md

Treat expired/not-yet-valid directory objects as Errors.

Closes #431

See merge request tpo/core/arti!448

Doing this will make us treat caches that send us these objects as
not-working, and close circuits to them instead of trying over and
over.

The case where we add a document from the cache requires special
handling: it isn't actually a error to find an expired document in
our cache (unless the passage of time itself is erroneous, which is
a debatable proposition at best).

Fixes #431.

Improved handling for retriable errors in circmgr

Closes #427 and #421

See merge request tpo/core/arti!443

# Conflicts:
#   doc/semver_status.md

The old version of this function was error-prone, and in fact had
errors: it was too easy to forget to add non-persistent fields, and
that's exactly what we forgot in a few cases
(`microdescriptor_missing`, `circ_history`, and
`suspicious_behavior_warned`).

The new version of this function consumes both of the incoming
Guards, and constructs every field explicitly so that we can't
forget to list any.

Closes #429.

Previously, we treated successfully building a circuit to a guard as
a "success", and any failure, including a directory cache failure,
as a failure.  With this change, guards now have separate
success/failure and retry status for circuit usage and directory
usage.

This change is needed for guard-as-directory retry to have
reasonable behavior.  Otherwise, when a guard succeeds at building a
circuit, that clears the directory-is-failing status and makes us
retry the guards to quickly.

This will help when we give Guards a DirStatus as well.

Previously the code would do stuff like

```
    schedule = RetrySchedule::new(INITIAL_DELAY);
```

which is needlessly verbose, since the schedule already keeps track
of its initial delay.

It's about to be shared between fallbacks and guards.

This lets us say that the UsageMismatch cases in some parts of the
code reflect a programming error (RetryTime::Never), whereas in
other case it reflects another circuit request getting to the
circuit first (RetryTime::Immediate).

For each case, describe its semantics (in addition to when you would
create it).

Explain the relationship between After and At.

Stop saying "Strategy": we renamed this type to "RetryTime".

Also add tests for RetryTime comparison functions to make sure they
work as expected.