ntp: check for reasonable time and stratum < 10

[iliana]

Context from #4087 (comment):

What we think happened here is the boundary NTP zones considered themselves authoritative without having upstream connectivity, and responded to other NTP zones with a 1980-era timestamp. The telling factor here is the stratum 11 lines in tracking.log, which imply the boundary NTP service was serving stratum 10.

We could most easily work around this by ensuring we don't consider the host in sync until the stratum is < 10. ... We could also set up an epoch before which time cannot be to consider ourselves in sync, which might be a good additional defense?

This adds these checks. The epoch I've chosen for no particular reason is UNIX time 1234567890 (Fri Feb 13 23:31:30 2009 UTC); there are plenty of times after this that would not make sense but it at least ensures it is not December 1986.

[citrus-it]

Looks reasonable to me. Thanks for getting to the bottom of what happened here.