validator: trim TTLs by RRSIG's expiration and original TTL
A down-side is that validation can now modify the validated RRset on success. I checked all transitive call sites that it's OK. The change is pretty simple; I just hand-tested it a bit with faketime.
Fixes https://gitlab.labs.nic.cz/knot/knot-resolver/issues/319