DirProvider: Better NetDir accessors.

Right now the only accessor is latest_netdir, which returns the latest NetDir regardless of whether it is live or not. At a minimum, we should also provide an accessor that makes sure that the directory is not "too expired" to use, and use it in more places.

We should audit everything that calls latest_netdir, opt_netdir, netdir, and so on to see which function they should really be calling.

Incidentally this will let us remove circmgr::Error::ExpiredConsensus.