sd-event: use CLOCK_BOOTTIME for rate limits

When a rate limit is armed, for example via StartLimitInterval=, and the
machine is suspended, the rate limit's "clock" is suspended as well,
since the elapse checks use CLOCK_MONOTONIC. This then causes unexpected
situations where a rate limit armed via StartLimitInterval=1h, followed
by a 10 hour suspend, would elapse after 11 hours total.

Let's avoid this by switching the rate limits to CLOCK_BOOTTIME, which
works the same as CLOCK_MONOTONIC, but accounts for the time spent in
suspend as well.

There's one slight concern when it comes to upgrade path - the old
"begin" value of the rate limit is stored as CLOCK_MONOTONIC, but after
upgrading systemd and serializing/deserializing the state it will be
suddenly compared against now(CLOCK_BOOTTIME), which might cause some
rate limits to elapse "prematurely". But this is just a one-time thing,
after which the rate limit timers should re-assess themselves.

Resolves: #42912

src/basic/ratelimit.c

@@ -14,7 +14,7 @@ bool ratelimit_below(RateLimit *rl) {
         if (!ratelimit_configured(rl))
                 return true;
 
-        ts = now(CLOCK_MONOTONIC);
+        ts = now(CLOCK_BOOTTIME);
 
         if (rl->begin <= 0 ||
             usec_sub_unsigned(ts, rl->begin) > rl->interval) {
@@ -54,5 +54,5 @@ usec_t ratelimit_left(const RateLimit *rl) {
         if (rl->begin == 0)
                 return 0;
 
-        return usec_sub_unsigned(ratelimit_end(rl), now(CLOCK_MONOTONIC));
+        return usec_sub_unsigned(ratelimit_end(rl), now(CLOCK_BOOTTIME));
 }