Add Kani model verification

[ChristopherRabotin]

https://model-checking.github.io/kani/getting-started.html

In light of #126 , I think it's important to check that operations on Epochs and Durations are free of errors, especially at the limits of their representations. This issue aims to implement Kani's model verification in hifitime.

[ChristopherRabotin]

• No panic in normalize with the i16 max and min for centuries and any nanoseconds.
• No panic in normalize for any i16 for centuries and any nanoseconds.

I'm not quite sure what else to check since that's arguably the most risky operation and everything else relies on Duration working correctly.