Avoid possible overflow when converting between coarse stamp to approx ms

Our coarse monotonic time conversion code can overflow on some platforms.

In particular, passing a large rate to a token bucket will overflow on iOS, and any other platform where monotime.numerator^2^ / monotime.denominator > 512.

I have a fix that makes sure that token bucket's rate_per_sec_to_rate_per_sec() can't cause an overflow. I can do tests and a changes file after nickm answers some of my remaining questions.

Gaba, this is a fix on a refactor for legacy/trac#25766 (moved), which was originally for sponsor 8. Are refactor bug fixes covered by sponsor 31 now?