Add and use ts_interval() helper

Add and use ts_interval() helper

ts_delta() returns a signed result, which cannot hold an interval
larger than 2^31-1 seconds.  Intervals like this have been seen when
admins set password expiration dates more than 68 years in the future.

Add a second helper ts_interval() which returns an unsigned result,
and has the arguments reversed so that the start time is first.  Use
it in warn_pw_expiry() to handle the password expiration case, in the
GSS krb5 mech where we return an unsigned context or credential
lifetime to the caller, and in the KEYRING ccache type where we
compute an unsigned keyring timeout.

ticket: 9071 (new)