validator: trim TTLs by RRSIG's expiration and original TTL

A down-side is that validation can now modify the validated RRset
on success.  I checked all transitive call sites that it's OK.
The change is pretty simple; I just hand-tested it a bit with faketime.
29 jobs for validate-trim-ttls
in 54 minutes and 39 seconds and was queued for 8 seconds