consider replacing legacy ntpd

in #41337 (comment 2994235), i said:

i wonder if we should just not switch to chrony or ntpd-rs (only in sid rn, hopefully part of %Debian 13 trixie upgrade ?).

further discussion in https://anarc.at/blog/2022-01-23-chrony/

we're looking at trixie, so let's consider this more seriously, as ntpd is kind of a serious piece of legacy infrastructure, and a rather significant attack surface.