tor-checkable: Use checked arithmetic
Make sure that arithmetic with SystemTime and Duration fits into SystemTime. If the result does not fit, set the affected boundary to None. After all it implies that this point in time is not reachable on the system.
Avoids integer overflow or panic, depending on debug or release build.
Please note that I had one failing job which succeeded at a second try: https://gitlab.torproject.org/stoeckmann/arti/-/jobs/494924
I don't know if this is related to the change. I doubt that an overflow ever occurred, but it would feel wrong to not mention it here.