When comparing instances, we should use saturating varieties to help
ensure that we can't hit panics.

This change bans uses of `std::time::Instant::{duration_since, elapsed,
sub}` via clippy. Uses are ported to using
`Instant::saturating_duration_since`.

Related to linkerd/linkerd2#7748

Signed-off-by: Oliver Gould <ver@buoyant.io>

* fix uses of `Instant::sub`

It looks like clippy's disallowed methods can't detect the use of
disallowed *operators*, so #1456 misses a bunch of uses of the `-`
operator on `Instant`s, mostly in metrics, tap, and the log timestamp
formatter.

This fixes all of them that I could find.

* fix accidentally changed `Duration` subs