validator: trim TTLs by RRSIG's expiration and original TTL

A down-side is that validation can now modify the validated RRset
on success.  I checked all transitive call sites that it's OK.
The change is pretty simple; I just hand-tested it a bit with faketime.
27 jobs for validate-trim-ttls
in 44 minutes and 28 seconds and was queued for 2 seconds