Remove dependency on vulnerable time versions

[tgeoghegan]

We got a security advisory on the time crate: https://github.com/divviup/janus/security/dependabot/9

We pull in the vulnerable version via chrono 0.4.23. Even if we turn off the oldtime feature, other things in our tree depend on chrono and use that feature. I think the way forward is to wait for a chrono release that doesn't depend on time. Fortunately, this is already the case in their upcoming 0.5 release, but I don't know when that will come out.

In the meantime, the chrono maintainers assure us that chrono doesn't use the vulnerable APIs from time, so I don't think we need to do anything.

[divergentdave]

Done in #1917