Consolidate timeout clamping into VerifyCredentialResponse

In preparation for supporting RESPONSE_CRED_INCORRECT with nonzero
timeout, consolidate the timeout clamping into VerifyCredentialResponse.

Specifically, change the timeout clamping logic in
VerifyCredentialResponse#fromTimeout(Duration) (which previously was
called only for SoftwareRateLimiter responses) to be identical to the
clamping logic in SyntheticPasswordManager#responseFromTimeout() (which
was used for Weaver responses).  Then replace calls to the latter method
with the former, and remove the latter method.

This only change in behavior is how negative timeouts from the
SoftwareRateLimiter are handled.  This does not matter, since
SoftwareRateLimiter never returns negative timeouts.

Bug: 423038471
Test: atest FrameworksServicesTests:com.android.server.locksettings
Flag: EXEMPT refactor
Change-Id: Ie67513e3bd2888ab92cb63ac393c217e356a1382