Changes in tendermint:

Change Time implementation to crate time.
chrono has soundness issues (see RUSTSEC-2020-0159) and does not seem
to be actively maintained.

Ensure Time can only have values that are valid for Google protobuf
Timestamp messages. Add ErrorDetail variant DateOutOfRange to report
when this restriction is not met.

Remove conversions between Time and chrono::DateTime, replacing them
with conversions from/to time::OffsetDateTime.
Conversion from time::OffsetDateTime is made fallible with
a TryFrom impl.

Add Time methods checked_add and checked_sub.
These should be used instead of the overloaded operators that broke
the operator convention by returning a Result.

Changes in tendermint-pbt-gen:

Change the time stragegies and helpers to produce
time::OffsetDateTime values.
Add strategies to generate date-time values and RFC 3339 strings
in the range valid for protobuf Timestamp messages.

Changes in tendermint-proto:

Provide another helper in the serializers::timestamp module,
one that formats into a provided fmt::Write object.

Changes in tendermint-rpc:

Use `OffsetDateTime` and `Date` types provided by the `time` crate
in query operands instead of their `chrono` counterparts.

Require the timestamp to be in the validity range (years 1-9999 in UTC)
and the nanosecond member value to not exceed  999_999_999.

Rename ErrorDetail::TimestampOverflow to TimestampNanosOutOfRange,
because the old variant was not very informative (the chained
TryFromIntError did not help) and we also use it for the above-range
case now which is not an overflow.

Add a unit test to exercise the check.

- More ergonomic signature
- A non-allocating implementation

Co-authored-by: Thane Thomson <thane@informal.systems>

Co-authored-by: Thane Thomson <thane@informal.systems>