timerfd: Use saturating sbintime conversions

[jfree]

Summary

Some timerfd consumers set expirations with timespec tv_sec components
larger than 2^31 - 1. In such cases, converting that timespec to
sbintime results in data loss or sign flip, yielding a shorter
expiration than desired.

To avoid this problem, use saturating timespec-to-sbintime conversion
functions. These will clamp the converted sbintime to SBT_MAX under
circumstances where the normal conversion functions would overflow.

Saturating conversions still result in data loss, but the consequences
are less severe, causing problems only after SBT_MAX (~68 years) of
system uptime elapses.

[markj]

Is this covered by the timerfd tests you posted already?

sys/kern/sys_timerfd.c

404

Do you need to catch overflow here too?

[jfree]

Saturate next expiration sbintime