Crash bug in tor_timegm

It looks like the assertion in tor_timegm is triggerable with bad inputs, according to asn. That's no good: we call it on untrusted inputs from directory objects.

Latest version of my preferred fix is in branch "timegm_assert_v2". It needs a little cleanup and a changes file. It might not be minimal.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information