refactor: fix time-purity by introducing Instant parameters

[thomaseizinger]

In its current implementation, boringtun is impure w.r.t. time because it calls Instant::now and Instant::elapsed internally. To test time-related functionality, the mock-instant dependency is currently used.

This is unnecessary and can also be solved by introducing Instant parameters to all necessary functions.

This PR does that in a fully-backwards compatible way by introducing _at functions for all necessary public functions that require the current time.

Resolves: #391.